EUVD-2026-80540
GHSA-rvmw-48g6-x73g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local IIO device access (AV:L, PR:L); lifetime race raises complexity (AC:H); UAF is DoS-dominant (A:H) with at most incidental memory-safety corruption (I:L) and no real disclosure primitive (C:N).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: Tie IIO dma fence lock lifetime to the fence
The iio_dma_fence implementation currently uses a lock embedded in the iio_dmabuf_priv. But the iio_dma_fence can outlive the iio_dmabuf_priv, which can cause a use-after-free.
Tie the lifetime of the lock to the lifetime of the fence by embedding them in the same struct.
We can't just hold a reference to the iio_dmabuf_priv from the iio_dma_fence since iio_buffer_dmabuf_release() might sleep and the fence release callback is not allowed to sleep.
Note that the dma_fence framework now has an internal lock that gets used when the passing NULL for lock in dma_fence_init(), but in order to allow this patch to be backportable use an external lock.
AnalysisAI
Use-after-free in the Linux kernel's IIO buffer DMABUF path where an iio_dma_fence can outlive the iio_dmabuf_priv structure that holds its embedded lock, so a fence signal or release callback can touch a freed lock object. Affected kernels are Linux 6.11 through the fixed releases 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1, and exploitation requires local access to a host whose hardware/driver exposes the IIO DMABUF buffer interface with permission to open the IIO device node (CVSS PR:L, no UI). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a Linux host running an affected kernel (6.11 through the fixed 6.12.110/6.18.51/7.2.5/7.3-rc1) whose hardware/driver exposes the IIO buffer DMABUF interface, and a process with permission to open that IIO device node and issue DMABUF attach/enqueue operations that create dma_fences. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a use-after-free (CWE-416, mislabeled by the input as 'Information Disclosure' and CWE:N/A) in the Linux kernel's IIO buffer DMABUF subsystem, where an iio_dma_fence outlives the iio_dmabuf_priv that holds its lock. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released kernel update: upgrade to Linux 6.12.110, 6.18.51, 7.2.5 or 7.3-rc1, or backport the upstream fix commits 6865d79fca17a80fbd60c12550ca9a5e0e20e0eb (stable), 510497e31be4f241103507315a859e2085ccb081, 8b3e221590181a8beb3735bbabf166df02c839b5 and f25ec4627d935dedfb5fe83bd2c2678cdcc19611 from https://git.kernel.org/stable/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux hosts running 6.11 or later that have not been updated to the vendor-fixed releases 6.12.110, 6.18.51, 7.2.5, or 7.3-rc1, and confirm whether the IIO DMABUF buffer interface is exposed; restrict local access to IIO device nodes to trusted users and monitor affected hosts for crashes or unexpected local privilege activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today