CVE-2026-64498
N/A
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: hw-consumer: free scan_mask on buffer release
The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer: hw-consumer: remove redundant scan_mask flexible array").
Before that change, the scan mask storage was embedded in struct hw_consumer_buffer, so iio_hw_buf_release() could free the whole allocation with a single kfree(hw_buf).
That commit moved the scan mask to a separate bitmap_zalloc() allocation stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged.
Free the scan mask in iio_hw_buf_release() before freeing the buffer wrapper.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 9a2e1233d38c460ad07f36901931f3674a32d1ed < fb8e18f8ca724bd4de4643cad5b7c7230b9a5a71 | affected |
| Linux | Linux | 9a2e1233d38c460ad07f36901931f3674a32d1ed < 6325d6e2204327965b849c0a16efb6ac9202e5a8 | affected |
| Linux | Linux | 7.1 | affected |
| Linux | Linux | 0 < 7.1 | unaffected |
| Linux | Linux | 7.1.4 <= 7.1.* | unaffected |
| Linux | Linux | 7.2-rc1 <= * | unaffected |
Weaknesses
References
- https://git.kernel.org/stable/c/fb8e18f8ca724bd4de4643cad5b7c7230b9a5a71
- https://git.kernel.org/stable/c/6325d6e2204327965b849c0a16efb6ac9202e5a8
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.