CVE-2026-89940

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Tie IIO dma fence lock lifetime to the fence The `iio_dma_fence` implementation currently uses a lock embedded in the `iio_dmabuf_priv`. But the `iio_dma_fence` can outlive the `iio_dmabuf_priv`, which can cause a use-after-free. Tie the lifetime of the lock to the lifetime of the fence by embedding them in the same struct. We can't just hold a reference to the `iio_dmabuf_priv` from the `iio_dma_fence` since `iio_buffer_dmabuf_release()` might sleep and the fence release callback is not allowed to sleep. Note that the `dma_fence` framework now has an internal lock that gets used when the passing `NULL` for `lock` in `dma_fence_init()`, but in order to allow this patch to be backportable use an external lock.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/510497e31be4f241103507315a859e2085ccb081
https://git.kernel.org/stable/c/6865d79fca17a80fbd60c12550ca9a5e0e20e0eb
https://git.kernel.org/stable/c/8b3e221590181a8beb3735bbabf166df02c839b5
https://git.kernel.org/stable/c/f25ec4627d935dedfb5fe83bd2c2678cdcc19611

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-16 11:17

Updated : 2026-09-16 11:17

NVD link : CVE-2026-89940

Mitre link : CVE-2026-89940

CVE.ORG link : CVE-2026-89940

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-89940", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f", "lessThan": "6865d79fca17a80fbd60c12550ca9a5e0e20e0eb", "versionType": "git"}, {"status": "affected", "version": "3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f", "lessThan": "510497e31be4f241103507315a859e2085ccb081", "versionType": "git"}, {"status": "affected", "version": "3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f", "lessThan": "8b3e221590181a8beb3735bbabf166df02c839b5", "versionType": "git"}, {"status": "affected", "version": "3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f", "lessThan": "f25ec4627d935dedfb5fe83bd2c2678cdcc19611", "versionType": "git"}], "programFiles": ["drivers/iio/industrialio-buffer.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.110", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.51", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.5", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iio/industrialio-buffer.c"], "defaultStatus": "affected"}]}], "published": "2026-09-16T11:17:03.610", "references": [{"url": "https://git.kernel.org/stable/c/510497e31be4f241103507315a859e2085ccb081", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6865d79fca17a80fbd60c12550ca9a5e0e20e0eb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8b3e221590181a8beb3735bbabf166df02c839b5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f25ec4627d935dedfb5fe83bd2c2678cdcc19611", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Tie IIO dma fence lock lifetime to the fence\n\nThe `iio_dma_fence` implementation currently uses a lock embedded in the\n`iio_dmabuf_priv`. But the `iio_dma_fence` can outlive the\n`iio_dmabuf_priv`, which can cause a use-after-free.\n\nTie the lifetime of the lock to the lifetime of the fence by embedding them\nin the same struct.\n\nWe can't just hold a reference to the `iio_dmabuf_priv` from the\n`iio_dma_fence` since `iio_buffer_dmabuf_release()` might sleep and the\nfence release callback is not allowed to sleep.\n\nNote that the `dma_fence` framework now has an internal lock that gets used\nwhen the passing `NULL` for `lock` in `dma_fence_init()`, but in order to\nallow this patch to be backportable use an external lock."}], "lastModified": "2026-09-16T11:17:03.610", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}