CVE-2026-98669

A flaw was found in the Linux kernel's Industrial I/O (IIO) subsystem. During device unregistration, the kernel disables and deactivates device buffers without acquiring the required lock to synchronize teardown with active buffer-mode claims. A local user could exploit this race condition to cause a Denial of Service (DoS) through a kernel crash caused by an invalid buffer state.

This vulnerability has been rated as having a Moderate severity because exploitation requires local privileged access and precise timing during device unregistration, limiting the attack impact to a denial of service. The Industrial I/O (IIO) subsystem is generally relevant only to systems equipped with specialized sensor or data acquisition hardware, which is uncommon in typical enterprise server deployments. Consequently, the likelihood of unintentional exposure or exploitation under default enterprise configurations remains low.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.