CVE-2026-89942: iio: buffer: Fix potential use-after-free in anonymous buffer release
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: Fix potential use-after-free in anonymous buffer release
An anonymous buffer handle holds a reference to the underlying IIO device. The reference is dropped in the buffer handle's release function. If the device has been removed, either through unbind or hot-unplug, the buffer handle might hold the last reference.
The release function takes the mutex for the buffer using a guard, which means the unlock happens after all the code in the function, including iiodeviceput(). If the anonymous buffer holds the last reference this might free both the IIO device and the buffer, which contains the mutex, leading to use-after-free when the mutex is unlocked.
Fix this by using a scoped guard just around the buffer dmabuf list access, making sure the mutex is unlocked before releasing the IIO device.
Version 10 of the patch that introduced this issue used this exact scheme of first unlocking and then dropping the reference [1]. During review it was suggested to use a guard instead, and version 11 made that change [2].
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Use a scoped guard only around the anonymous buffer's dmabuf list access, ensuring the buffer mutex is unlocked before calling iio_device_put() to prevent use-after-free.
Event History
Frequently Asked Questions
When can this use-after-free occur?
It can occur when an anonymous IIO buffer handle is released after its underlying IIO device has been removed through unbind or hot-unplug. The handle must hold the last reference to the IIO device, causing the device and buffer containing the mutex to be freed before the mutex unlock runs.
What condition must be present for an attacker or user action to trigger the issue?
The affected path requires an anonymous buffer handle associated with an IIO device, removal of that device, and subsequent release of a handle that retains the final device reference. The provided information does not specify a remote attack vector or required privileges.
What does the fix change?
The fix limits the mutex guard to access to the buffer DMA-BUF list. It ensures the mutex is unlocked before iio_device_put() can release the final reference and free the IIO device and buffer.