CVE-2026-98669: iio: buffer: serialize buffer teardown with mode claims
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: serialize buffer teardown with mode claims
Buffer-mode claims hold mlock to guarantee that the device remains in buffer mode until the claim is released. Normal buffer updates take infoexistlock followed by mlock in iioupdatebuffers().
However, iiodeviceunregister() disables and deactivates all buffers without taking mlock. This can invalidate buffer state, including activescanmask, while a buffer-mode claim is held.
Take mlock in iiodisableallbuffers() so that unregister honors the mode-claim lifetime guarantee. The infoexistlock -> mlock ordering matches iioupdatebuffers().
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux Industrial I/O buffer subsystem are relevant when a device can be unregistered while a buffer-mode claim remains held. The issue concerns buffer teardown and mode-claim lifetime handling.
What conditions are required for the issue to occur?
A buffer-mode claim must be active, and device unregistration must disable and deactivate buffers concurrently with that claim. The unsafe condition arises because teardown previously occurred without taking mlock, unlike normal buffer updates.
What change resolves the synchronization problem?
The fix takes mlock in iio_disable_all_buffers() during device unregistration. This serializes teardown with buffer-mode claims and preserves the established info_exist_lock followed by mlock locking order.