CVE-2026-89941

A flaw was found in the Linux kernel's IIO (Industrial I/O) buffer component. The iio_dma_fence implementation incorrectly uses kfree() instead of kfree_rcu() for releasing DMA fence objects. This improper memory deallocation can lead to a use-after-free vulnerability. An attacker could potentially exploit this to cause a system crash (denial of service) or achieve arbitrary code execution.

An RCU lifetime bug in the IIO/DMABUF buffer path can free an iio_dma_fence with kfree() even though dma_fence rules require RCU-safe freeing when a custom release callback is used. Another CPU or RCU reader may still observe the dma_fence after release, which creates a use-after-free risk in kernel memory. For the CVSS the PR:L is used for the paranoid score because an attacker would need local access to an IIO device or a process context that can exercise the IIO DMABUF fence path, but full administrator privileges are not necessarily required in systems that delegate device access. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact or privilege escalation due to a kernel use-after-free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.