From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E430550C289 for ; Wed, 16 Sep 2026 10:40:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555209; cv=none; b=VRB68E8ndpVczuYPT4TCjYa9giu+OFRZMC9f/tYRmZ3FvtPfpLk9penU/AcKUVo/+/x2P+kwlSXVQ9dLxjvktr9+DaZIANwnVnWwGiWd5uz8IOJSPA4VGTNYxg2sXKML7aNy0EQ7hqbc147NeM6PK0ZUPR8acc8qlUxQMWE1w04= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789555209; c=relaxed/simple; bh=JOoiBGNBPdCjUWBxfVa0LrIpCM2rUW+BxeaZ2/cHmmY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=rKUzlLZOMEB4fOIWEbRHjUSOcBLJq+SfiXBQn9Xl7z7oFuO7If8emTrtxfQmBt7NqUBB26Sm+V0N7m8sbIKTDi/bhzrL2ihgsV1k9r/7zh3sgfgL21yYOLyQAOCe62ETLBAaUD2R0Ejxo8ZArkpb8wbJWZI28j+6xkn5CO2qhXY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OKbRnLIx; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="OKbRnLIx" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DCF011F000FF; Wed, 16 Sep 2026 10:40:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789555202; bh=ItdUP32l4nqsgSOeB1RB1IalR8VS1+A9ue+NIJVfItE=; h=From:To:Cc:Subject:Date:Reply-To; b=OKbRnLIxMf+lyCgH3aACVYbXhKqH+1EX/n56/ROL/3n2+NCeVRrGplhIcCS+FqkZE wnHcY8yinIcx0gukZ0kxe6Qf8xPQfAAtCUbJF8WPDdZZhVwwwyIXTGRD2GaC7a7Yw8 L46lMvnHarxGkiUPTsM2CyoaRmBY079lJrSYfUbs= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89940: iio: buffer: Tie IIO dma fence lock lifetime to the fence Date: Wed, 16 Sep 2026 11:31:10 +0100 Message-ID: <2026091647-CVE-2026-89940-d522@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2924; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=A3GafWUFByc66qalFahJiqtkEy7/lTHAlDCfBVA47rU=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmr8mebPc7bIK770irxgjoXu+X2lbtCt0SuezBz9Y9sY y+n325bO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAir6MYFuw78dD/8T7xb1zH 1zZKzJE7Irhl/gGGBcvlyhjS99h/1tULa1P0Vkxdlis1EQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Tie IIO dma fence lock lifetime to the fence The `iio_dma_fence` implementation currently uses a lock embedded in the `iio_dmabuf_priv`. But the `iio_dma_fence` can outlive the `iio_dmabuf_priv`, which can cause a use-after-free. Tie the lifetime of the lock to the lifetime of the fence by embedding them in the same struct. We can't just hold a reference to the `iio_dmabuf_priv` from the `iio_dma_fence` since `iio_buffer_dmabuf_release()` might sleep and the fence release callback is not allowed to sleep. Note that the `dma_fence` framework now has an internal lock that gets used when the passing `NULL` for `lock` in `dma_fence_init()`, but in order to allow this patch to be backportable use an external lock. The Linux kernel CVE team has assigned CVE-2026-89940 to this issue. Affected and fixed versions =========================== Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 6.12.110 with commit 6865d79fca17a80fbd60c12550ca9a5e0e20e0eb Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 6.18.51 with commit 510497e31be4f241103507315a859e2085ccb081 Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 7.2.5 with commit 8b3e221590181a8beb3735bbabf166df02c839b5 Issue introduced in 6.11 with commit 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f and fixed in 7.3-rc1 with commit f25ec4627d935dedfb5fe83bd2c2678cdcc19611 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89940 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/iio/industrialio-buffer.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/6865d79fca17a80fbd60c12550ca9a5e0e20e0eb https://git.kernel.org/stable/c/510497e31be4f241103507315a859e2085ccb081 https://git.kernel.org/stable/c/8b3e221590181a8beb3735bbabf166df02c839b5 https://git.kernel.org/stable/c/f25ec4627d935dedfb5fe83bd2c2678cdcc19611