CVE-2026-89940

A flaw was found in the Linux kernel's Industrial I/O (IIO) subsystem. The iio_dma_fence implementation uses a lock embedded in iio_dmabuf_priv. However, iio_dma_fence can outlive iio_dmabuf_priv, leading to a use-after-free vulnerability. This can result in memory corruption and potentially lead to system instability or other security impacts.

An IIO DMABUF dma_fence can outlive its iio_dmabuf_priv object while the fence still points to a spinlock stored inside that object. Later dma_fence operations may take the stale lock pointer after iio_dmabuf_priv has been freed, which creates a use-after-free in kernel synchronization state. For the CVSS the PR:L is used because a local user or process needs access to the IIO buffer DMABUF interface and a suitable dmabuf workflow, but full administrative privileges are not inherently required if the device node is delegated. The issue is not network reachable and requires local interaction with the device interface. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.