Is there a patch available for CVE-2026-98669?

Yes, a patch is available for CVE-2026-98669. Update the affected software to the latest version immediately.

Linux CVE-2026-98669

EUVD-2026-103923

2026-10-18 Linux

GHSA-h3hh-6rf8-4cq6

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: serialize buffer teardown with mode claims

Buffer-mode claims hold mlock to guarantee that the device remains in buffer mode until the claim is released. Normal buffer updates take info_exist_lock followed by mlock in iio_update_buffers().

However, iio_device_unregister() disables and deactivates all buffers without taking mlock. This can invalidate buffer state, including active_scan_mask, while a buffer-mode claim is held.

Take mlock in iio_disable_all_buffers() so that unregister honors the mode-claim lifetime guarantee. The info_exist_lock -> mlock ordering matches iio_update_buffers().

Affected VersionsENISA

Linux patch: 6.18.56

Linux 5.15.137 <5.16

Linux 6.1.60 <6.2

Linux a9c471892d75847671a246619c2148578f22bbc6

Linux 6.2

Linux patch: 6.12.113

Linux 0a8565425afd8ba0e1a0ea73e21da119ee6dacea <b466db9e68b4741af85f6c017e2bb0a2f025053f

Linux patch: 7.3-rc6

Linux 7bca0af538a49dacb1470f233be0676bdc09605b

Linux 0a8565425afd8ba0e1a0ea73e21da119ee6dacea <e63188d77e10c0951bf67da6c295f768fd1abf4b

Linux patch: 7.2.10

Linux 0a8565425afd8ba0e1a0ea73e21da119ee6dacea <84bb0fc46ccf6a545b8fdf57cda83770186ed8dd

Linux patch: 0

Linux 0a8565425afd8ba0e1a0ea73e21da119ee6dacea <89f3852a28fcf7bab599280cb082baa0675536db

Affected Packages

euvd linux fix: 5.16, 6.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 18, 2026 - 17:19 EUVD

CVE Published

Oct 18, 2026 - 15:45 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.