Executive brief
The Linux kernel's Industrial I/O (IIO) subsystem contains a memory safety flaw in how it manages buffer device references during cleanup. When an application closes an IIO buffer handle that holds the last reference to a hardware sensor device, the kernel may attempt to access memory that has already been freed, potentially leading to system crashes or security issues.
Technical details
A use-after-free vulnerability exists in the IIO buffer subsystem's anonymous buffer release handler (iio_buffer_chrdev_release). The flaw occurs because the code holds a mutex lock using a guard that persists through the entire release function, including after the call to iio_device_put(). If the buffer is the last reference holder to the IIO device, iio_device_put() will deallocate both the device and its associated buffer structure. When the guard scope ends and attempts to unlock the mutex, the memory containing the mutex has already been freed, causing a use-after-free condition. The vulnerability requires local access and occurs during normal buffer cleanup operations. A fix has been deployed by changing the mutex guard to a scoped_guard that unlocks before the iio_device_put() call, ensuring the mutex is not accessed after memory deallocation.
Affected products
- Linux Linux kernel 5.x through 6.x (and potentially earlier versions)
Timeline
- 2026-09-16: disclosed: Vulnerability published on NVD
- 2026-08-07: patched: Patch merged upstream (commit 6288b593e76eb10329326f2cd51e32557203b9e5)