https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 16:00:09 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89942 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iio: buffer: Fix potential use-after-free in anonymous buffer release</p> <p>An anonymous buffer handle holds a reference to the underlying IIO device. The reference is dropped in the buffer handle&#39;s release function. If the device has been removed, either through unbind or hot-unplug, the buffer handle might hold the last reference.</p> <p>The release function takes the mutex for the buffer using a guard, which means the unlock happens after all the code in the function, including `iio_device_put()`. If the anonymous buffer holds the last reference this might free both the IIO device and the buffer, which contains the mutex, leading to use-after-free when the mutex is unlocked.</p> <p>Fix this by using a scoped guard just around the buffer dmabuf list access, making sure the mutex is unlocked before releasing the IIO device.</p> <p>Version 10 of the patch that introduced this issue used this exact scheme of first unlocking and then dropping the reference [1]. During review it was suggested to use a guard instead, and version 11 made that change [2].</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iio: buffer: Fix potential use-after-free in anonymous buffer release</p> <p>An anonymous buffer handle holds a reference to the underlying IIO device. The reference is dropped in the buffer handle&#39;s release function. If the device has been removed, either through unbind or hot-unplug, the buffer handle might hold the last reference.</p> <p>The release function takes the mutex for the buffer using a guard, which means the unlock happens after all the code in the function, including `iio_device_put()`. If the anonymous buffer holds the last reference this might free both the IIO device and the buffer, which contains the mutex, leading to use-after-free when the mutex is unlocked.</p> <p>Fix this by using a scoped guard just around the buffer dmabuf list access, making sure the mutex is unlocked before releasing the IIO device.</p> <p>Version 10 of the patch that introduced this issue used this exact scheme of first unlocking and then dropping the reference [1]. During review it was suggested to use a guard instead, and version 11 made that change [2].</p> https://vulnerability.circl.lu/vuln/cve-2026-89942