Executive brief
The Linux kernel's atlas-sensor chemical IIO driver has a use-after-free vulnerability in its device removal code. When a sensor is unplugged or the driver is unloaded while data acquisition is active, a queued work item can execute after the sensor data structure has been freed, causing a system crash or potential code execution. This affects any system using an Atlas chemical sensor for pH or other measurements.
Technical details
The atlas-sensor driver requests a hardware data-ready IRQ using devm_request_threaded_irq(); the threaded handler queues irq_work (atlas_work_handler()) that calls iio_trigger_poll(). Because the IRQ is devm-managed, free_irq() executes from the devres unwind after atlas_remove() returns without draining the pending irq_work. Once a buffer is enabled, conversion-complete IRQs fire continuously, queueing work; a pending irq_work can execute after the atlas_data and trigger structures are freed. When atlas_work_handler() dereferences data->trig via container_of(), it triggers a use-after-free. The fix replaces the irq_work queue mechanism with a direct call to iio_trigger_poll_nested() from the threaded handler, allowing free_irq() to properly drain the handler and close the race window. Affected versions: Linux 6.4 and later.
Affected products
- Linux Linux kernel 6.4 through patched version
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-08-02: patched: Fix committed upstream (commit be61c8c6252671ecf1fee0ad90f87669e0be1e20)