CVE-2026-98669 - Vulnerability Details

- iio: buffer: serialize buffer teardown with mode claims

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: serialize buffer teardown with mode claims

Buffer-mode claims hold mlock to guarantee that the device remains in
buffer mode until the claim is released. Normal buffer updates take
info_exist_lock followed by mlock in iio_update_buffers().

However, iio_device_unregister() disables and deactivates all buffers
without taking mlock. This can invalidate buffer state, including
active_scan_mask, while a buffer-mode claim is held.

Take mlock in iio_disable_all_buffers() so that unregister honors the
mode-claim lifetime guarantee. The info_exist_lock -> mlock ordering
matches iio_update_buffers().

Published: 2026-10-18

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel the Industrial I/O subsystem can terminate a device while a buffer‑mode claim is held, because the unregister routine disables all buffers without acquiring the mlock lock that protects those claims. This race condition, identified as CWE‑366, can corrupt buffer state such as the active_scan_mask, potentially causing inconsistent behavior or data loss during IIO operations.

Affected Systems

The flaw affects all Linux kernel implementations that include the IIO buffer management code. No specific kernel versions are listed, meaning any kernel that contains the unpatched disable path may be impacted.

Risk and Exploitability

The CVSS score of 4.1 indicates moderate severity, and the EPSS score of < 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local or privileged access to the IIO device and the ability to trigger device unregistration while a buffer‑mode claim is active, but the patch eliminates the race by acquiring mlock during sidebar teardown.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a9c471892d75847671a246619c2148578f22bbc6`	affected	< 261f54966ebf45ced5fe5e1fe5119c6c44e140ab
`7bca0af538a49dacb1470f233be0676bdc09605b`	affected	< cebbecb26d22368440c4779f8275d790cf347177
`0a8565425afd8ba0e1a0ea73e21da119ee6dacea`	affected	< 6a728408ff522b749c2a3c7e68f44e861fa0dbfb
`0a8565425afd8ba0e1a0ea73e21da119ee6dacea`	affected	< 89f3852a28fcf7bab599280cb082baa0675536db
`0a8565425afd8ba0e1a0ea73e21da119ee6dacea`	affected	< b466db9e68b4741af85f6c017e2bb0a2f025053f
`0a8565425afd8ba0e1a0ea73e21da119ee6dacea`	affected	< e63188d77e10c0951bf67da6c295f768fd1abf4b
`0a8565425afd8ba0e1a0ea73e21da119ee6dacea`	affected	< 84bb0fc46ccf6a545b8fdf57cda83770186ed8dd
`5.15.137`	affected	< 5.15.224
`6.1.60`	affected	< 6.1.191

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0a8565425afd8ba0e1a0ea73e21da119ee6dacea,89f3852a28fcf7bab599280cb082baa0675536db)`	affected	code_commit	—
`[0a8565425afd8ba0e1a0ea73e21da119ee6dacea,b466db9e68b4741af85f6c017e2bb0a2f025053f)`	affected	code_commit	—
`[0a8565425afd8ba0e1a0ea73e21da119ee6dacea,e63188d77e10c0951bf67da6c295f768fd1abf4b)`	affected	code_commit	—
`[0a8565425afd8ba0e1a0ea73e21da119ee6dacea,84bb0fc46ccf6a545b8fdf57cda83770186ed8dd)`	affected	code_commit	—
`a9c471892d75847671a246619c2148578f22bbc6`	affected	code_commit	—
`7bca0af538a49dacb1470f233be0676bdc09605b`	affected	code_commit	—
`[5.15.137,5.16)`	affected	generic	—
`[6.1.60,6.2)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.2`	affected	generic	—
`[0,6.2)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	generic	—
`[6.18.56,6.19.0)`	unaffected	generic	—
`[7.2.10,7.3.0)`	unaffected	generic	—
`[7.3-rc6,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to the latest Linux kernel version that incorporates the iio buffer teardown patch provided by your distribution.
If using a custom or older kernel, cherry‑pick the commit that adds mlock acquisition to iio_disable_all_buffers() from the supplied commit URLs and rebuild the kernel.
Modify the unregistration path so that it takes mlock before disabling all buffers, ensuring the lock ordering aligns with the buffer update routine to prevent race conditions described by CWE‑366.

Generated by OpenCVE AI on October 23, 2026 at 06:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98669.mbox
https://git.kernel.org/stable/c/261f54966ebf45ced5fe5e1fe5119c6c44e140ab
https://git.kernel.org/stable/c/6a728408ff522b749c2a3c7e68f44e861fa0dbfb
https://git.kernel.org/stable/c/84bb0fc46ccf6a545b8fdf57cda83770186ed8dd
https://git.kernel.org/stable/c/89f3852a28fcf7bab599280cb082baa0675536db
https://git.kernel.org/stable/c/b466db9e68b4741af85f6c017e2bb0a2f025053f
https://git.kernel.org/stable/c/cebbecb26d22368440c4779f8275d790cf347177
https://git.kernel.org/stable/c/e63188d77e10c0951bf67da6c295f768fd1abf4b
https://nvd.nist.gov/vuln/detail/CVE-2026-98669
https://www.cve.org/CVERecord?id=CVE-2026-98669

History

Fri, 30 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/261f54966ebf45ced5fe5e1fe5119c6c44e140ab https://git.kernel.org/stable/c/cebbecb26d22368440c4779f8275d790cf347177

Fri, 23 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Thu, 22 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-366
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98669.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98669 https://www.cve.org/CVERecord?id=CVE-2026-98669
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/6a728408ff522b749c2a3c7e68f44e861fa0dbfb

Sun, 18 Oct 2026 22:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: iio: buffer: serialize buffer teardown with mode claims Buffer-mode claims hold mlock to guarantee that the device remains in buffer mode until the claim is released. Normal buffer updates take info_exist_lock followed by mlock in iio_update_buffers(). However, iio_device_unregister() disables and deactivates all buffers without taking mlock. This can invalidate buffer state, including active_scan_mask, while a buffer-mode claim is held. Take mlock in iio_disable_all_buffers() so that unregister honors the mode-claim lifetime guarantee. The info_exist_lock -> mlock ordering matches iio_update_buffers().
Title		iio: buffer: serialize buffer teardown with mode claims
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/84bb0fc46ccf6a545b8fdf57cda83770186ed8dd https://git.kernel.org/stable/c/89f3852a28fcf7bab599280cb082baa0675536db https://git.kernel.org/stable/c/b466db9e68b4741af85f6c017e2bb0a2f025053f https://git.kernel.org/stable/c/e63188d77e10c0951bf67da6c295f768fd1abf4b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:45:05.836Z

Updated: 2026-10-30T12:38:36.653Z

Reserved: 2026-09-25T10:25:14.363Z

Link: CVE-2026-98669

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:20.190

Modified: 2026-10-30T13:21:17.290

Link: CVE-2026-98669

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98669 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T06:45:07Z

Weaknesses

CWE-366
Race Condition within a Thread

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object