CVE-2026-89938

7.8 HIGH

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: This vulnerability allows for a use-after-free condition in the Linux kernel's atlas sensor driver, leading to potential memory corruption or privilege escalation.
Exploitability: Exploitation requires the attacker to have access to the system and knowledge of the specific conditions that trigger the use-after-free condition. The vulnerability is not easily exploitable without detailed knowledge of the system state.
Blast radius: If exploited, the impact could be severe, potentially leading to system instability, data corruption, or privilege escalation.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the fixed version 5.19.1 or later.

kerneluse-after-freememory-corruption

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF The atlas driver requests its hardware data-ready IRQ with devm_request_threaded_irq(); its threaded handler queues an irq_work, atlas_work_handler(), that calls iio_trigger_poll(data->trig). The IRQ is devm-managed, so free_irq() runs from the devres unwind after atlas_remove() returns without flushing that irq_work. Once a buffer is enabled, conversion-complete IRQs keep firing and queueing it; a pending irq_work can therefore run after the unwind has freed atlas_data/indio_dev and the trigger, when atlas_work_handler() derives the atlas_data pointer via container_of() and dereferences data->trig, a use-after-free. Call iio_trigger_poll_nested() directly from the threaded handler instead of bouncing through irq_work. free_irq() then drains the threaded handler, closing the window; other iio drivers with a threaded data-ready IRQ do the same (e.g. bmi270). This issue was found by an in-house static analysis tool.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.