{"id":"CVE-2026-89942","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-89942","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Fix potential use-after-free in anonymous buffer release\n\nAn anonymous buffer handle holds a reference…","details":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Fix potential use-after-free in anonymous buffer release\n\nAn anonymous buffer handle holds a reference to the underlying IIO device.\nThe reference is dropped in the buffer handle's release function. If the\ndevice has been removed, either through unbind or hot-unplug, the buffer\nhandle might hold the last reference.\n\nThe release function takes the mutex for the buffer using a guard, which\nmeans the unlock happens after all the code in the function, including\n`iio_device_put()`. If the anonymous buffer holds the last reference this\nmight free both the IIO device and the buffer, which contains the mutex,\nleading to use-after-free when the mutex is unlocked.\n\nFix this by using a scoped guard just around the buffer dmabuf list access,\nmaking sure the mutex is unlocked before releasing the IIO device.\n\nVersion 10 of the patch that introduced this issue used this exact scheme\nof first unlocking and then dropping the reference [1]. During review it\nwas suggested to use a guard instead, and version 11 made that change [2].","published":"2026-09-16T11:17:03.860","modified":"2026-09-16T11:17:03.860","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/6288b593e76eb10329326f2cd51e32557203b9e5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6d4bdbf7bad63e759bf20259c527f69a1209e3dd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ab53077511cde811bf3ee219426c522329c41226"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f1f8f0e8e0af9cae8150658dc7bb51332f984893"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-16T11:17:03.860"}}