CVE-2026-89941 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Make IIO DMA fence release RCU-safe The `dma_fence` documentation states that if a custom release implementation is provided, the `dma_fence` object must be freed in an RCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`, which might result in a use-after-free. Remove the custom `release` implementation. This makes the DMA fence core fall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence. This requires that the fence be the first member of `struct iio_dma_fence`. Using the default release method for extended DMA fence structures is a common pattern.

Is your site exposed to CVE-2026-89941?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Other References

https://git.kernel.org/stable/c/06a9460b8b792e109cbc934a856d02e5cff217ef https://git.kernel.org/stable/c/11cef99491117d4264603df159c4ff5f3845a059 https://git.kernel.org/stable/c/311595dc0b5621f74d8eb4dc38ef4efcdfe7e769 https://git.kernel.org/stable/c/8662e56c31cf23b61ca3d11b516efb94c35b8026

Frequently Asked Questions

What is CVE-2026-89941? +

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Make IIO DMA fence release RCU-safe The `dma_fence` documentation states that if a custom release implementation is provided, the `dma_fence` object must be freed in an RCU-safe way. The current `iio_dma_fence` implementation uses `kfree()`, which might result in a use-after-free. Remove the custom `release` implementation. This makes the DMA fence core fall back to `dma_fence_free()`, which calls `kfree_rcu()` on the fence. This requires that the fence be the first member of `struct iio_dma_fence`. Using the default release method for extended DMA fence structures is a common pattern. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-89941? +

CVE-2026-89941 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

How do I check if I'm vulnerable to CVE-2026-89941? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-89941

Description

CVSS v3.1 Score

References

Other References

Frequently Asked Questions

Don't wait for an exploit