CVE-2026-63930

Summary

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: hw-consumer: fix use-after-free in error path

In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer.

Fix this by using list_for_each_entry_safe().

Affected Software

VendorProductVersion RangeStatus
LinuxLinux48b66f8f936f369bb1a43c12aedbfeb2975baf4c < b71893c57730809c222766e5718bb33610f11963affected
LinuxLinux48b66f8f936f369bb1a43c12aedbfeb2975baf4c < 2ff615fc455acda5425c4900160cbe11cfea4449affected
LinuxLinux48b66f8f936f369bb1a43c12aedbfeb2975baf4c < d2759d49860b9a39b5cde2fb88e4b822ddf5f58faffected
LinuxLinux48b66f8f936f369bb1a43c12aedbfeb2975baf4c < 29783e6b6ec0b7152a15e53a063f17537e81177daffected
LinuxLinux48b66f8f936f369bb1a43c12aedbfeb2975baf4c < e965627f0d442bfcae3f496c90cb653fb0917a61affected
LinuxLinux48b66f8f936f369bb1a43c12aedbfeb2975baf4c < a3763ae33476328cf8d661742deb9daec78eac96affected
LinuxLinux48b66f8f936f369bb1a43c12aedbfeb2975baf4c < 9319c94f63ed10723afd738d79f5617daba87cc8affected
LinuxLinux48b66f8f936f369bb1a43c12aedbfeb2975baf4c < 6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4affected
LinuxLinux4.16affected
LinuxLinux0 < 4.16unaffected
LinuxLinux5.10.259 <= 5.10.*unaffected
LinuxLinux5.15.210 <= 5.15.*unaffected
LinuxLinux6.1.176 <= 6.1.*unaffected
LinuxLinux6.6.143 <= 6.6.*unaffected
LinuxLinux6.12.93 <= 6.12.*unaffected
LinuxLinux6.18.35 <= 6.18.*unaffected
LinuxLinux7.0.12 <= 7.0.*unaffected
LinuxLinux7.1 <= *unaffected

Weaknesses

References