HIGH Introduced in 6.11
iio DmaFence UAF
CVE-2026-89941
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Make IIO DMA fence release RCU-safe The `dma_fence` documentation states that if a custom release implementation is provided, the `dma_fence` object must be freed in an RCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`, which might result in a use-after-free. Remove the custom `release` implementation. This makes the DMA fence core fall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence. This requires that the fence be the first member of `struct iio_dma_fence`. Using the default release method for extended DMA fence structures is a common pattern.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the IIO DMA fence release path, where a custom release callback frees the fence object with kfree() instead of an RCU-safe method, allowing concurrent readers to access freed memory. Local users with access to IIO buffer devices can trigger this through DMABUF enqueue operations, potentially leading to memory corruption, privilege escalation, or denial of service.
Vulnerability analysis
The IIO DMA buffer interface handles cleanup of internal synchronization objects through a custom path that frees memory immediately instead of waiting for any concurrent readers elsewhere in the kernel to finish. This allows the object to be destroyed while another thread still holds a reference to it, resulting in a use-after-free. The fix removes the unsafe custom cleanup so the core framework falls back to its default release handling, which defers freeing until all concurrent references have been dropped. The vulnerability is reachable from local userspace through the IIO buffer memory-mapping interface, using a file descriptor for an IIO device; on systems where these devices are available to non-root users, no special privileges are needed to trigger it.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.11 | 6.12.110 | 311595dc0b56 |
| 7.2 | 6.11 | 7.2.5 | 11cef9949111 |
| 6.18 | 6.11 | 6.18.51 | 06a9460b8b79 |
| mainline | 6.11 | 7.3-rc1 | 8662e56c31cf |
| cip/6.12 | 6.11 | 6.12.111-cip32 | 311595dc0b56 |