CVE-2026-89941

7.8 HIGH

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: This vulnerability in the Linux kernel allows for a use-after-free condition in IIO DMA fence handling, which could lead to potential memory corruption or privilege escalation.
Exploitability: Exploitation requires access to the kernel and knowledge of the specific use-after-free condition. Precondition is the presence of custom `release` implementation in `iio_dma_fence`.
Blast radius: If exploited, the impact could be severe, potentially leading to system instability or privilege escalation.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the Linux kernel version 6.1.19 or later.

kerneluse-after-freeprivilege-escalation

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Make IIO DMA fence release RCU-safe The `dma_fence` documentation states that if a custom release implementation is provided, the `dma_fence` object must be freed in an RCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`, which might result in a use-after-free. Remove the custom `release` implementation. This makes the DMA fence core fall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence. This requires that the fence be the first member of `struct iio_dma_fence`. Using the default release method for extended DMA fence structures is a common pattern.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.