PT-2026-61246 · Linux · Linux
CVE-2026-63929
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: Fix DMA fence leak in iio buffer enqueue dmabuf()
iio buffer enqueue dmabuf() allocates a struct iio dma fence (104 bytes,
kmalloc-128) via kmalloc obj()+dma fence init(), which sets the initial
kref to 1. It then calls dma resv add fence() which takes a second
reference (kref=2), and stores a raw pointer in block->fence.
On the success path the function returns without calling dma fence put()
to release the initial reference, so every buffer enqueue permanently
leaks one kmalloc-128 allocation.
The iio buffer cleanup() work item only releases the temporary reference
taken during completion signalling by iio buffer signal dmabuf done();
the initial reference from dma fence init() is never released.
With four iio rwdev instances at 240kHz and 512 samples per buffer,
this produces ~1875 kmalloc-128 allocations per second matching the
observed slab growth exactly. A test with ftrace confirmed that the
dma fence destroy event was never triggered.
Fix by calling dma fence put() after dma resv add fence(), transferring
ownership of the fence to the DMA reservation object. The DMA fence then
gets properly discarded after being signalled.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux