CVE-2026-89938 - Vulnerability Details

- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF

The atlas driver requests its hardware data-ready IRQ with
devm_request_threaded_irq(); its threaded handler queues an irq_work,
atlas_work_handler(), that calls iio_trigger_poll(data->trig).

The IRQ is devm-managed, so free_irq() runs from the devres unwind after
atlas_remove() returns without flushing that irq_work. Once a buffer is
enabled, conversion-complete IRQs keep firing and queueing it; a pending
irq_work can therefore run after the unwind has freed atlas_data/indio_dev
and the trigger, when atlas_work_handler() derives the atlas_data pointer
via container_of() and dereferences data->trig, a use-after-free.

Call iio_trigger_poll_nested() directly from the threaded handler instead
of bouncing through irq_work. free_irq() then drains the threaded handler,
closing the window; other iio drivers with a threaded data-ready IRQ do the
same (e.g. bmi270).

This issue was found by an in-house static analysis tool.

Published: 2026-09-16

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The atlas‑sensor driver in the Linux kernel frees its data‑ready IRQ resources while a threaded handler may still be queued. The handler, waiting on conversion‑complete interrupts, dereferences freed data, resulting in a classic Use‑After‑Free (CWE‑416) that can corrupt memory or allow arbitrary code execution.

Affected Systems

The vulnerability affects the atlas‑sensor driver present in all Linux kernel builds prior to the fix. No specific kernel version range is listed in the advisory, but any kernel containing the original signature of this driver is at risk. The issue was identified by static analysis and subsequently patched in later kernel commits.

Risk and Exploitability

The CVSS score of 7.8 classifies the flaw as high severity, yet the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not cited in the CISA KEV catalog. Exploitation would likely require a local privileged context to trigger device removal while the threaded work remains pending. Overall, the risk is moderate but can be effectively reduced through patching.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7103b99b031cb0ff6979331757bfc4893f37ae9e`	affected	< f64b437641b5a70c18bb0fd38da2b69d8926c871
`7103b99b031cb0ff6979331757bfc4893f37ae9e`	affected	< 91e12b0fbd7047d02bf4ef4dbc491b9ef0159250
`7103b99b031cb0ff6979331757bfc4893f37ae9e`	affected	< 2071624c3d0f497ca91da78858e6f30d7112fea6
`7103b99b031cb0ff6979331757bfc4893f37ae9e`	affected	< 30b0d44c978bbc857bd68b71dab371805653de70
`7103b99b031cb0ff6979331757bfc4893f37ae9e`	affected	< be61c8c6252671ecf1fee0ad90f87669e0be1e20

Linux

affected

Version	Status	Constraints
`4.8`	affected	—
`0`	unaffected	< 4.8
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7103b99b031cb0ff6979331757bfc4893f37ae9e,f64b437641b5a70c18bb0fd38da2b69d8926c871)`	affected	code_commit	—
`[7103b99b031cb0ff6979331757bfc4893f37ae9e,91e12b0fbd7047d02bf4ef4dbc491b9ef0159250)`	affected	code_commit	—
`[7103b99b031cb0ff6979331757bfc4893f37ae9e,2071624c3d0f497ca91da78858e6f30d7112fea6)`	affected	code_commit	—
`[7103b99b031cb0ff6979331757bfc4893f37ae9e,30b0d44c978bbc857bd68b71dab371805653de70)`	affected	code_commit	—
`[7103b99b031cb0ff6979331757bfc4893f37ae9e,be61c8c6252671ecf1fee0ad90f87669e0be1e20)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.8`	affected	generic	—
`[0,4.8)`	unaffected	generic	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that contains the atlas‑sensor fix (commit 2071624c3d0f497ca91da78858e6f30d7112fea6).
Rebuild or reload the atlas‑sensor driver module to ensure the patched handler is in use.
If a kernel upgrade cannot be applied immediately, remove or disable the atlas sensor device until the patch is deployed.

Generated by OpenCVE AI on September 18, 2026 at 07:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0017.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2071624c3d0f497ca91da78858e6f30d7112fea6
https://git.kernel.org/stable/c/30b0d44c978bbc857bd68b71dab371805653de70
https://git.kernel.org/stable/c/91e12b0fbd7047d02bf4ef4dbc491b9ef0159250
https://git.kernel.org/stable/c/be61c8c6252671ecf1fee0ad90f87669e0be1e20
https://git.kernel.org/stable/c/f64b437641b5a70c18bb0fd38da2b69d8926c871

History

Fri, 18 Sep 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 16 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF The atlas driver requests its hardware data-ready IRQ with devm_request_threaded_irq(); its threaded handler queues an irq_work, atlas_work_handler(), that calls iio_trigger_poll(data->trig). The IRQ is devm-managed, so free_irq() runs from the devres unwind after atlas_remove() returns without flushing that irq_work. Once a buffer is enabled, conversion-complete IRQs keep firing and queueing it; a pending irq_work can therefore run after the unwind has freed atlas_data/indio_dev and the trigger, when atlas_work_handler() derives the atlas_data pointer via container_of() and dereferences data->trig, a use-after-free. Call iio_trigger_poll_nested() directly from the threaded handler instead of bouncing through irq_work. free_irq() then drains the threaded handler, closing the window; other iio drivers with a threaded data-ready IRQ do the same (e.g. bmi270). This issue was found by an in-house static analysis tool.
Title		iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2071624c3d0f497ca91da78858e6f30d7112fea6 https://git.kernel.org/stable/c/30b0d44c978bbc857bd68b71dab371805653de70 https://git.kernel.org/stable/c/91e12b0fbd7047d02bf4ef4dbc491b9ef0159250 https://git.kernel.org/stable/c/be61c8c6252671ecf1fee0ad90f87669e0be1e20 https://git.kernel.org/stable/c/f64b437641b5a70c18bb0fd38da2b69d8926c871

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T10:32:27.012Z

Updated: 2026-09-16T14:40:24.952Z

Reserved: 2026-09-11T19:38:34.776Z

Link: CVE-2026-89938

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T11:17:03.323

Modified: 2026-09-16T15:18:19.210

Link: CVE-2026-89938

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-18T07:45:05Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object