Executive brief
A vulnerability was identified in the Linux kernel's Industrial I/O (IIO) subsystem, which handles data from various hardware sensors. A flaw in how the system cleans up memory during an error could lead to a system crash or unpredictable behavior. This issue primarily affects the stability of devices using specific hardware consumer buffers.
Technical details
A use-after-free vulnerability exists in the iio_hw_consumer_alloc() function within drivers/iio/buffer/industrialio-hw-consumer.c. The root cause is the use of list_for_each_entry() instead of list_for_each_entry_safe() in the err_put_buffers cleanup path. When iio_buffer_put() is called and a buffer's reference count drops to zero, the buffer is freed; the loop then attempts to access the next pointer from the now-freed memory. This can be triggered during a failed allocation sequence, potentially leading to a kernel panic or memory corruption. Patches have been released across multiple stable kernel branches (e.g., 5.10.259+, 5.15.210+, 6.1.176+, 6.6.33+).
Affected products
- Linux Linux 4.16 to 6.9.x
Timeline
- 2026-04-30: other: Vulnerability fix authored
- 2026-07-19: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/29783e6b6ec0b7152a15e53a063f17537e81177d
- https://git.kernel.org/stable/c/2ff615fc455acda5425c4900160cbe11cfea4449
- https://git.kernel.org/stable/c/6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4
- https://git.kernel.org/stable/c/9319c94f63ed10723afd738d79f5617daba87cc8
- https://git.kernel.org/stable/c/a3763ae33476328cf8d661742deb9daec78eac96
- https://git.kernel.org/stable/c/b71893c57730809c222766e5718bb33610f11963
- https://git.kernel.org/stable/c/d2759d49860b9a39b5cde2fb88e4b822ddf5f58f