CVE-2026-63930

iio: buffer: hw-consumer: fix use-after-free in error path

State: Published
Severity: 7.8 High
Published: Jul 19, 2026
Updated: Aug 5, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: hw-consumer: fix use-after-free in error path

In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer.

Fix this by using list_for_each_entry_safe().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before b71893c57730809c222766e5718bb33610f11963Affected 48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before 2ff615fc455acda5425c4900160cbe11cfea4449Affected 48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before d2759d49860b9a39b5cde2fb88e4b822ddf5f58fAffected 48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before 29783e6b6ec0b7152a15e53a063f17537e81177dAffected 48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before e965627f0d442bfcae3f496c90cb653fb0917a61Affected 48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before a3763ae33476328cf8d661742deb9daec78eac96Affected 48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before 9319c94f63ed10723afd738d79f5617daba87cc8Affected 48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before 6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4Affected
LinuxLinux	4.16Affected before 4.16Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before b71893c57730809c222766e5718bb33610f11963Affected
48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before 2ff615fc455acda5425c4900160cbe11cfea4449Affected
48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before d2759d49860b9a39b5cde2fb88e4b822ddf5f58fAffected
48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before 29783e6b6ec0b7152a15e53a063f17537e81177dAffected
48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before e965627f0d442bfcae3f496c90cb653fb0917a61Affected
48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before a3763ae33476328cf8d661742deb9daec78eac96Affected
48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before 9319c94f63ed10723afd738d79f5617daba87cc8Affected
48b66f8f936f369bb1a43c12aedbfeb2975baf4c to before 6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4Affected

LinuxLinux

4.16Affected
before 4.16Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.