{"id":"CVE-2026-89941","summary":"iio: buffer: Make IIO DMA fence release RCU-safe","details":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Make IIO DMA fence release RCU-safe\n\nThe `dma_fence` documentation states that if a custom release\nimplementation is provided, the `dma_fence` object must be freed in an\nRCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`,\nwhich might result in a use-after-free.\n\nRemove the custom `release` implementation. This makes the DMA fence core\nfall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence.\nThis requires that the fence be the first member of `struct iio_dma_fence`.\n\nUsing the default release method for extended DMA fence structures is a\ncommon pattern.","modified":"2026-09-18T03:48:34.188349431Z","published":"2026-09-16T10:32:29.148Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89941.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/06a9460b8b792e109cbc934a856d02e5cff217ef"},{"type":"WEB","url":"https://git.kernel.org/stable/c/11cef99491117d4264603df159c4ff5f3845a059"},{"type":"WEB","url":"https://git.kernel.org/stable/c/311595dc0b5621f74d8eb4dc38ef4efcdfe7e769"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8662e56c31cf23b61ca3d11b516efb94c35b8026"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89941.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89941"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3e26d9f08fbe0b73e951a5e810fdb7a332b7e37f"},{"fixed":"311595dc0b5621f74d8eb4dc38ef4efcdfe7e769"},{"fixed":"06a9460b8b792e109cbc934a856d02e5cff217ef"},{"fixed":"11cef99491117d4264603df159c4ff5f3845a059"},{"fixed":"8662e56c31cf23b61ca3d11b516efb94c35b8026"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89941.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"fixed":"6.12.110"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.51"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89941.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}