CVE-2026-98669: iio: buffer: serialize buffer teardown with mode claims
iio: buffer: serialize buffer teardown with mode claims
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Update iio_disable_all_buffers() to acquire mlock during buffer teardown, preserving the info_exist_lock -> mlock ordering used by iio_update_buffers(), so iio_device_unregister() serializes teardown with buffer-mode claims.
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux Industrial I/O buffer subsystem are relevant when a device can be unregistered while a buffer-mode claim remains held. The issue concerns buffer teardown and mode-claim lifetime handling.
What conditions are required for the issue to occur?
A buffer-mode claim must be active, and device unregistration must disable and deactivate buffers concurrently with that claim. The unsafe condition arises because teardown previously occurred without taking mlock, unlike normal buffer updates.
What change resolves the synchronization problem?
The fix takes mlock in iio_disable_all_buffers() during device unregistration. This serializes teardown with buffer-mode claims and preserves the established info_exist_lock followed by mlock locking order.