Executive brief
The Linux kernel's Industrial I/O (IIO) subsystem uses DMA buffers to transfer data from hardware sensors. A memory management flaw caused a lock structure to be freed while a DMA fence object still held a reference to it, allowing use-after-free corruption. An attacker with direct hardware access or ability to control IIO device buffers could trigger memory corruption and kernel crashes.
Technical details
The vulnerability is a use-after-free in the IIO buffer DMA fence implementation. The `iio_dma_fence` object was using a spinlock embedded in the `iio_dmabuf_priv` structure, but the fence can outlive the private buffer data structure after it is released. When the fence was later freed, it would attempt to access the already-freed lock, causing memory corruption. The fix moves the spinlock from `iio_dmabuf_priv` to `iio_dma_fence` to tie the lock's lifetime to the fence object itself. This is a local privilege escalation or denial-of-service vector requiring ability to interact with IIO DMABUF interfaces. The patch was backported across multiple stable kernel versions.
Affected products
- Linux Linux Kernel Multiple versions with IIO DMABUF support; patched in commit f25ec4627d935dedfb5fe83bd2c2678cdcc19611
Timeline
- 2026-09-16: disclosed: CVE-2026-89940 published
- 2026-09-11: patched: Fix committed by Greg Kroah-Hartman to stable tree