PT-2026-61246 · Linux · Linux
CVE-2026-63929
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: Fix DMA fence leak in iio buffer enqueue dmabuf()
iio buffer enqueue dmabuf() allocates a struct iio dma fence (104 bytes,
kmalloc-128) via kmalloc obj()+dma fence init(), which sets the initial
kref to 1. It then calls dma resv add fence() which takes a second
reference (kref=2), and stores a raw pointer in block->fence.
On the success path the function returns without calling dma fence put()
to release the initial reference, so every buffer enqueue permanently
leaks one kmalloc-128 allocation.
The iio buffer cleanup() work item only releases the temporary reference
taken during completion signalling by iio buffer signal dmabuf done();
the initial reference from dma fence init() is never released.
With four iio rwdev instances at 240kHz and 512 samples per buffer,
this produces ~1875 kmalloc-128 allocations per second matching the
observed slab growth exactly. A test with ftrace confirmed that the
dma fence destroy event was never triggered.
Fix by calling dma fence put() after dma resv add fence(), transferring
ownership of the fence to the DMA reservation object. The DMA fence then
gets properly discarded after being signalled.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux