PT-2026-61246 · Linux · Linux

CVE-2026-63929

·

Publicado

2026-07-19

·

Atualizado

2026-07-19

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: Fix DMA fence leak in iio buffer enqueue dmabuf()
iio buffer enqueue dmabuf() allocates a struct iio dma fence (104 bytes, kmalloc-128) via kmalloc obj()+dma fence init(), which sets the initial kref to 1. It then calls dma resv add fence() which takes a second reference (kref=2), and stores a raw pointer in block->fence.
On the success path the function returns without calling dma fence put() to release the initial reference, so every buffer enqueue permanently leaks one kmalloc-128 allocation.
The iio buffer cleanup() work item only releases the temporary reference taken during completion signalling by iio buffer signal dmabuf done(); the initial reference from dma fence init() is never released.
With four iio rwdev instances at 240kHz and 512 samples per buffer, this produces ~1875 kmalloc-128 allocations per second matching the observed slab growth exactly. A test with ftrace confirmed that the dma fence destroy event was never triggered.
Fix by calling dma fence put() after dma resv add fence(), transferring ownership of the fence to the DMA reservation object. The DMA fence then gets properly discarded after being signalled.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Identificadores relacionados

CVE-2026-63929

Produtos afetados

Linux