CVE-2026-64496

A flaw was found in the Linux kernel's Industrial I/O (IIO) event subsystem. A local user can exploit a race condition during the reset of the event FIFO (First-In, First-Out) buffer. This occurs when another thread accesses a newly allocated file descriptor before the FIFO reset is complete. This can lead to an out-of-bounds read, potentially disclosing sensitive kernel memory to the user.

Red Hat has rated this issue as Moderate impact because successful exploitation requires local user access and permission to interact with Industrial I/O device nodes, which are not configured or exposed on standard enterprise installations. The vulnerability involves a race window during event buffer reinitialization across concurrent threads sharing a file descriptor table, which could allow an unauthorized local actor to read uninitialized adjacent kernel memory. Because access is confined to local environments with specialized hardware sensors and cannot be triggered remotely, the blast radius is limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.