CVE-2026-89941: iio: buffer: Make IIO DMA fence release RCU-safe
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: Make IIO DMA fence release RCU-safe
The dmafence documentation states that if a custom release implementation is provided, the dmafence object must be freed in an RCU-safe way. The current iiodmafence implementation uses kfree(), which might result in a use-after-free.
Remove the custom release implementation. This makes the DMA fence core fall back to dmafencefree(), which calls kfreercu() on the fence. This requires that the fence be the first member of struct iiodmafence.
Using the default release method for extended DMA fence structures is a common pattern.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel IIO buffer code with the affected custom iIO DMA fence release implementation are exposed. The issue concerns lifetime handling of iio_dma_fence objects.
What condition can trigger the vulnerability?
The problem can occur when an iio_dma_fence is released while RCU-based access to the DMA fence may still be possible. The custom release path used kfree() rather than an RCU-safe free operation, creating a potential use-after-free.
What is the remediation?
Apply the available kernel fixes referenced in the advisory. The fix removes the custom release implementation so the DMA fence core uses dma_fence_free(), which frees the fence through kfree_rcu().
Is there a documented workaround if the fix cannot be applied immediately?
No workaround is provided in the available data. The documented remediation is to use the corrected release behavior that relies on the DMA fence core's RCU-safe freeing path.