{"id":"CVE-2026-89942","published":"2026-09-16T11:17:03.860","lastModified":"2026-09-16T15:18:19.573","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Fix potential use-after-free in anonymous buffer release\n\nAn anonymous buffer handle holds a reference to the underlying IIO device.\nThe reference is dropped in the buffer handle's release function. If the\ndevice has been removed, either through unbind or hot-unplug, the buffer\nhandle might hold the last reference.\n\nThe release function takes the mutex for the buffer using a guard, which\nmeans the unlock happens after all the code in the function, including\n`iio_device_put()`. If the anonymous buffer holds the last reference this\nmight free both the IIO device and the buffer, which contains the mutex,\nleading to use-after-free when the mutex is unlocked.\n\nFix this by using a scoped guard just around the buffer dmabuf list access,\nmaking sure the mutex is unlocked before releasing the IIO device.\n\nVersion 10 of the patch that introduced this issue used this exact scheme\nof first unlocking and then dropping the reference [1]. During review it\nwas suggested to use a guard instead, and version 11 made that change [2].","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/6288b593e76eb10329326f2cd51e32557203b9e5","tags":[]},{"url":"https://git.kernel.org/stable/c/6d4bdbf7bad63e759bf20259c527f69a1209e3dd","tags":[]},{"url":"https://git.kernel.org/stable/c/ab53077511cde811bf3ee219426c522329c41226","tags":[]},{"url":"https://git.kernel.org/stable/c/f1f8f0e8e0af9cae8150658dc7bb51332f984893","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows an attacker to exploit a use-after-free condition in the Linux kernel's IIO buffer handling, potentially leading to arbitrary code execution or system instability.","exploitability":"Exploitation requires the attacker to have the ability to unbind or hot-unplug the IIO device, making it moderately hard to exploit.","blast_radius":"If exploited, the vulnerability could lead to system-wide instability or arbitrary code execution on the affected system.","remediation":"Upgrade to the fixed version 5.19.71 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","use-after-free","iio","buffer"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:43:00.489Z"}}