Junglewise Threat Intelligence

CVE-2026-89940: Linux kernel IIO buffer use-after-free in DMA fence lock

CVE-2026-89940 · Severity: high · CVSS 7.8 · Published 2026-09-16

Executive brief

The Linux kernel's Industrial I/O (IIO) subsystem uses DMA buffers to transfer data from hardware sensors. A memory management flaw caused a lock structure to be freed while a DMA fence object still held a reference to it, allowing use-after-free corruption. An attacker with direct hardware access or ability to control IIO device buffers could trigger memory corruption and kernel crashes.

Technical details

The vulnerability is a use-after-free in the IIO buffer DMA fence implementation. The `iio_dma_fence` object was using a spinlock embedded in the `iio_dmabuf_priv` structure, but the fence can outlive the private buffer data structure after it is released. When the fence was later freed, it would attempt to access the already-freed lock, causing memory corruption. The fix moves the spinlock from `iio_dmabuf_priv` to `iio_dma_fence` to tie the lock's lifetime to the fence object itself. This is a local privilege escalation or denial-of-service vector requiring ability to interact with IIO DMABUF interfaces. The patch was backported across multiple stable kernel versions.

Affected products

  • Linux Linux Kernel Multiple versions with IIO DMABUF support; patched in commit f25ec4627d935dedfb5fe83bd2c2678cdcc19611

Timeline

  • 2026-09-16: disclosed: CVE-2026-89940 published
  • 2026-09-11: patched: Fix committed by Greg Kroah-Hartman to stable tree

References

Related threats