UBUNTU-CVE-2026-89940: Use After Free
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Tie IIO dma fence lock lifetime to the fence The iiodmafence implementation currently uses a lock embedded in the iiodmabufpriv. But the iiodmafence can outlive the iiodmabufpriv, which can cause a use-after-free. Tie the lifetime of the lock to the lifetime of the fence by embedding them in the same struct. We can't just hold a reference to the iiodmabufpriv from the iiodmafence since iiobufferdmabufrelease() might sleep and the fence release callback is not allowed to sleep. Note that the dmafence framework now has an internal lock that gets used when the passing NULL for lock in dmafenceinit(), but in order to allow this patch to be backportable use an external lock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is rated with local attack vector, low attack complexity, low privileges required, and no user interaction. An attacker would need local access and an existing low-privileged account or process context.
What is the potential impact of successful exploitation?
Successful exploitation may result in high impact to confidentiality, integrity, and availability. The underlying flaw is a use-after-free involving an IIO DMA fence lock whose lifetime can outlast its associated DMA-BUF private data.
Which Ubuntu kernel packages are identified as affected?
The listed software includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.