Executive brief
A security vulnerability was identified in the Linux kernel's Industrial I/O (IIO) subsystem. A race condition during the creation of event file descriptors could allow a local attacker to read sensitive kernel memory. This occurs because the system briefly allows access to internal data buffers before they have been properly reset, potentially exposing information that should remain private.
Technical details
A race condition exists in iio_event_getfd() within the Linux kernel's IIO subsystem. The function creates an event file descriptor using anon_inode_getfd(), which installs the fd into the process table before the IIO FIFO buffer is reset. Because file descriptor tables are shared between threads, a concurrent thread can guess the new fd and initiate a read() while kfifo_reset_out() is executing. This causes the FIFO's 'out' index to advance incorrectly, leading to a buffer underflow. Consequently, subsequent reads can access data beyond the intended buffer limits, resulting in an out-of-bounds read that leaks adjacent kernel memory to userspace. The fix involves moving the FIFO reset before the file descriptor is installed.
Affected products
- Linux Linux Kernel b91accafbb10 to 9dc84ba4be5bbeb29ee49efe6cea2cb32c461424
Timeline
- 2026-07-06: disclosed: Initial patch authored
- 2026-07-24: patched: Patch committed to stable tree
- 2026-07-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/0d4a646d7f87ea3625fafe387043fddc6a2f5e7f
- https://git.kernel.org/stable/c/72c6aa8e0d74eab91b8694cde97dec088c248fee
- https://git.kernel.org/stable/c/9dc84ba4be5bbeb29ee49efe6cea2cb32c461424
- https://git.kernel.org/stable/c/9edefd4c56bee3fe331e0355d1f10a533134999d
- https://git.kernel.org/stable/c/a13ef1adbc62085b21b546b07b0be7e2fbf52150
- https://git.kernel.org/stable/c/af791d295737ea6b6ff2c8d8488462a49c14af01
- https://git.kernel.org/stable/c/d16a702ca7d29c0b7a9b509339d1b044a1cadb32