CVE-2026-89941

iio: buffer: Make IIO DMA fence release RCU-safe

State: Published
Severity: 7.8 High
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: Make IIO DMA fence release RCU-safe

The `dma_fence` documentation states that if a custom release implementation is provided, the `dma_fence` object must be freed in an RCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`, which might result in a use-after-free.

Remove the custom `release` implementation. This makes the DMA fence core fall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence. This requires that the fence be the first member of `struct iio_dma_fence`.

Using the default release method for extended DMA fence structures is a common pattern.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f to before 311595dc0b5621f74d8eb4dc38ef4efcdfe7e769Affected 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f to before 06a9460b8b792e109cbc934a856d02e5cff217efAffected 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f to before 11cef99491117d4264603df159c4ff5f3845a059Affected 3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f to before 8662e56c31cf23b61ca3d11b516efb94c35b8026Affected
LinuxLinux	6.11Affected before 6.11Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.