Executive brief
The Linux kernel's Industrial I/O (IIO) subsystem manages data buffers for sensor devices and hardware interfaces. A memory safety flaw in the DMA fence release mechanism could cause a system crash or allow an attacker with local access to read sensitive kernel memory or escalate privileges through use-after-free exploitation.
Technical details
The vulnerability is a use-after-free in the IIO DMA fence release handler. The custom `iio_buffer_dma_fence_release()` function used `kfree()` to free the fence structure, violating DMA fence API requirements that mandate RCU-safe deallocation when a custom release is provided. This could result in memory being freed while still referenced by RCU read-side critical sections. The fix removes the custom release handler and reorders struct members to allow the DMA fence core's default `dma_fence_free()` (which uses `kfree_rcu()`) to take over. Attack requires local system access and knowledge of IIO DMABUF interface usage patterns.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 through 7.2 (see git.kernel.org stable branches)
Timeline
- 2026-09-16: disclosed: CVE-2026-89941 published on NVD
- 2026-07-15: patched: Fix committed upstream (06a9460b8b792e109cbc934a856d02e5cff217ef)
- 2026-09-11: other: Stable kernel series releases