From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-89940: iio: buffer: Tie IIO dma fence lock lifetime to the fence
Date: Wed, 16 Sep 2026 11:31:10 +0100 [thread overview]
Message-ID: <2026091647-CVE-2026-89940-d522@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: Tie IIO dma fence lock lifetime to the fence
The `iio_dma_fence` implementation currently uses a lock embedded in the
`iio_dmabuf_priv`. But the `iio_dma_fence` can outlive the
`iio_dmabuf_priv`, which can cause a use-after-free.
Tie the lifetime of the lock to the lifetime of the fence by embedding them
in the same struct.
We can't just hold a reference to the `iio_dmabuf_priv` from the
`iio_dma_fence` since `iio_buffer_dmabuf_release()` might sleep and the
fence release callback is not allowed to sleep.
Note that the `dma_fence` framework now has an internal lock that gets used
when the passing `NULL` for `lock` in `dma_fence_init()`, but in order to
allow this patch to be backportable use an external lock.
The Linux kernel CVE team has assigned CVE-2026-89940 to this issue.
Affected and fixed versions
===========================
Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 6.12.110 with commit 6865d79fca17a80fbd60c12550ca9a5e0e20e0eb
Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 6.18.51 with commit 510497e31be4f241103507315a859e2085ccb081
Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 7.2.5 with commit 8b3e221590181a8beb3735bbabf166df02c839b5
Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 7.3-rc1 with commit f25ec4627d935dedfb5fe83bd2c2678cdcc19611
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-89940
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/iio/industrialio-buffer.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/6865d79fca17a80fbd60c12550ca9a5e0e20e0eb
https://git.kernel.org/stable/c/510497e31be4f241103507315a859e2085ccb081
https://git.kernel.org/stable/c/8b3e221590181a8beb3735bbabf166df02c839b5
https://git.kernel.org/stable/c/f25ec4627d935dedfb5fe83bd2c2678cdcc19611
reply other threads:[~2026-09-16 10:40 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026091647-CVE-2026-89940-d522@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.