PT-2026-61247 · Linux · Linux

CVE-2026-63930 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: hw-consumer: fix use-after-free in error path

In the err put buffers cleanup path of iio hw consumer alloc(), the code was using list for each entry() to iterate through buffers while calling iio buffer put() which can free the current buffer if refcount drops to 0. The list for each entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer.

Fix this by using list for each entry safe().

Correção

Identificadores relacionados

CVE-2026-63930

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4 · Nota
• https://git.kernel.org/stable/c/b71893c57730809c222766e5718bb33610f11963 · Nota
• https://git.kernel.org/stable/c/9319c94f63ed10723afd738d79f5617daba87cc8 · Nota
• https://git.kernel.org/stable/c/29783e6b6ec0b7152a15e53a063f17537e81177d · Nota
• https://git.kernel.org/stable/c/d2759d49860b9a39b5cde2fb88e4b822ddf5f58f · Nota
• https://git.kernel.org/stable/c/2ff615fc455acda5425c4900160cbe11cfea4449 · Nota
• https://git.kernel.org/stable/c/e965627f0d442bfcae3f496c90cb653fb0917a61 · Nota
• https://git.kernel.org/stable/c/a3763ae33476328cf8d661742deb9daec78eac96 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63930 · Nota de Segurança