CVE-2026-89940: iio: buffer: Tie IIO dma fence lock lifetime to the fence

CVE-2026-89940: iio: buffer: Tie IIO dma fence lock lifetime to the fence

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: Tie IIO dma fence lock lifetime to the fence

The `iio_dma_fence` implementation currently uses a lock embedded in the
`iio_dmabuf_priv`. But the `iio_dma_fence` can outlive the
`iio_dmabuf_priv`, which can cause a use-after-free.

Tie the lifetime of the lock to the lifetime of the fence by embedding them
in the same struct.

We can't just hold a reference to the `iio_dmabuf_priv` from the
`iio_dma_fence` since `iio_buffer_dmabuf_release()` might sleep and the
fence release callback is not allowed to sleep.

Note that the `dma_fence` framework now has an internal lock that gets used
when the passing `NULL` for `lock` in `dma_fence_init()`, but in order to
allow this patch to be backportable use an external lock.

The Linux kernel CVE team has assigned CVE-2026-89940 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 6.12.110 with commit 6865d79fca17a80fbd60c12550ca9a5e0e20e0eb
	Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 6.18.51 with commit 510497e31be4f241103507315a859e2085ccb081
	Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 7.2.5 with commit 8b3e221590181a8beb3735bbabf166df02c839b5
	Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 7.3-rc1 with commit f25ec4627d935dedfb5fe83bd2c2678cdcc19611

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89940
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/iio/industrialio-buffer.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6865d79fca17a80fbd60c12550ca9a5e0e20e0eb
	https://git.kernel.org/stable/c/510497e31be4f241103507315a859e2085ccb081
	https://git.kernel.org/stable/c/8b3e221590181a8beb3735bbabf166df02c839b5
	https://git.kernel.org/stable/c/f25ec4627d935dedfb5fe83bd2c2678cdcc19611