UBUNTU-CVE-2026-89941: Use After Free
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Make IIO DMA fence release RCU-safe The dmafence documentation states that if a custom release implementation is provided, the dmafence object must be freed in an RCU-safe way. The current iiodmafence implementation uses kfree(), which might result in a use-after-free. Remove the custom release implementation. This makes the DMA fence core fall back to dmafencefree(), which calls kfreercu() on the fence. This requires that the fence be the first member of struct iiodmafence. Using the default release method for extended DMA fence structures is a common pattern.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the iio_dma_fence implementation, remove the custom release implementation so the DMA fence core uses dma_fence_free() and kfree_rcu(); ensure the fence is the first member of struct iio_dma_fence.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The severity vector indicates local access, low attack complexity, low privileges required, and no user interaction. Exploitation would require an attacker or local process with some existing low-level access to the affected system.
Which Ubuntu kernel packages are listed as affected?
The listed software includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What is the security impact if exploitation succeeds?
The provided severity vector rates confidentiality, integrity, and availability impacts as high. The underlying flaw is a use-after-free involving IIO DMA fence release handling.