Executive brief
A memory leak was identified in the Linux kernel's Industrial I/O (IIO) subsystem. This component is responsible for handling data from sensors like accelerometers and converters. An exploit could allow a local user to exhaust system memory by repeatedly triggering certain data buffer operations, potentially leading to a system crash or significant performance degradation.
Technical details
A reference counting error in iio_buffer_enqueue_dmabuf() causes a DMA fence leak. The function allocates a struct iio_dma_fence and initializes its reference count to 1, then calls dma_resv_add_fence() which increments the count to 2. However, the initial reference is never released on the success path, causing a permanent leak of approximately 128 bytes for every buffer enqueue operation. In high-frequency sampling scenarios (e.g., 240kHz), this can result in thousands of leaked allocations per second, leading to slab memory exhaustion. The fix involves calling dma_fence_put() after dma_resv_add_fence() to properly transfer ownership.
Affected products
- Linux Linux Kernel 6.11, 6.12.93, 6.18.35, 7.0.12, 7.1
Timeline
- 2026-04-01: other: Patch authored
- 2026-07-19: disclosed: CVE published