EUVD-2026-80538
GHSA-cv98-fww9-9mfg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only teardown race (AV:L, AC:H) needing device access plus a privileged unbind (PR:L); impact is kernel crash/memory corruption (A:H, limited I:L) with no confidentiality primitive (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
The atlas driver requests its hardware data-ready IRQ with devm_request_threaded_irq(); its threaded handler queues an irq_work, atlas_work_handler(), that calls iio_trigger_poll(data->trig).
The IRQ is devm-managed, so free_irq() runs from the devres unwind after atlas_remove() returns without flushing that irq_work. Once a buffer is enabled, conversion-complete IRQs keep firing and queueing it; a pending irq_work can therefore run after the unwind has freed atlas_data/indio_dev and the trigger, when atlas_work_handler() derives the atlas_data pointer via container_of() and dereferences data->trig, a use-after-free.
Call iio_trigger_poll_nested() directly from the threaded handler instead of bouncing through irq_work. free_irq() then drains the threaded handler, closing the window; other iio drivers with a threaded data-ready IRQ do the same (e.g. bmi270).
This issue was found by an in-house static analysis tool.
AnalysisAI
Use-after-free in the Linux kernel's IIO atlas-sensor driver (Atlas Scientific chemical sensors) is reachable when an IIO buffer is enabled and the driver is torn down: the devm-managed data-ready IRQ keeps queueing an irq_work that calls iio_trigger_poll(data->trig), and free_irq() during the devres unwind after atlas_remove() never flushes that pending work, so atlas_work_handler() can dereference an already-freed trigger/indio_dev via container_of(). The driver has existed since Linux 4.8 and is only present on systems with real Atlas Scientific I2C sensor hardware attached; exploitation requires authenticated local access (typically root privileges to unbind the device or unload the module), with an enabled buffer, and it is constrained by a narrow race-timing window - the assessed impact is low integrity and high availability (denial of service / memory corruption on teardown) with no confidentiality impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a system that actually has an Atlas Scientific chemical sensor bound to the iio atlas-sensor driver (I2C hardware, not present on typical servers/desktops). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a use-after-free (CWE-416) triggered by a device-teardown race in the Linux kernel IIO Atlas Scientific chemical-sensor driver, not the information-disclosure issue implied by the input Tag. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.6.157, 6.12.110, 6.18.51 or 7.2.5 (or 7.3-rc1 and later), which contain the upstream change that invokes iio_trigger_poll_nested() directly from the threaded handler so free_irq() drains it; distribution kernels should be updated to a build carrying stable commits f64b437641b5a70c18bb0fd38da2b69d8926c871, 91e12b0fbd7047d02bf4ef4dbc491b9ef0159250, 2071624c3d0f497ca91da78858e6f30d7112fea6, 30b0d44c978bbc857bd68b71dab371805653de70 or be61c8c6252671ecf1fee0ad90f87669e0be1e20 as listed at https://git.kernel.org/stable/c/f64b437641b5a70c18bb0fd38da2b69d8926c871 and https://nvd.nist.gov/vuln/detail/CVE-2026-89938. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Linux kernel 4.8 or later with Atlas Scientific I2C sensors and confirm whether the affected IIO atlas-sensor driver is present. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today