Junglewise Threat Intelligence

CVE-2026-89941: Linux kernel IIO buffer use-after-free in DMA fence release

CVE-2026-89941 · Severity: high · CVSS 7.8 · Published 2026-09-16

Executive brief

The Linux kernel's Industrial I/O (IIO) subsystem manages data buffers for sensor devices and hardware interfaces. A memory safety flaw in the DMA fence release mechanism could cause a system crash or allow an attacker with local access to read sensitive kernel memory or escalate privileges through use-after-free exploitation.

Technical details

The vulnerability is a use-after-free in the IIO DMA fence release handler. The custom `iio_buffer_dma_fence_release()` function used `kfree()` to free the fence structure, violating DMA fence API requirements that mandate RCU-safe deallocation when a custom release is provided. This could result in memory being freed while still referenced by RCU read-side critical sections. The fix removes the custom release handler and reorders struct members to allow the DMA fence core's default `dma_fence_free()` (which uses `kfree_rcu()`) to take over. Attack requires local system access and knowledge of IIO DMABUF interface usage patterns.

Affected products

  • Linux Linux kernel multiple versions from 2.6.11 through 7.2 (see git.kernel.org stable branches)

Timeline

  • 2026-09-16: disclosed: CVE-2026-89941 published on NVD
  • 2026-07-15: patched: Fix committed upstream (06a9460b8b792e109cbc934a856d02e5cff217ef)
  • 2026-09-11: other: Stable kernel series releases

References

Related threats