PT-2026-61247 · Linux · Linux

CVE-2026-63930 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: hw-consumer: fix use-after-free in error path

In the err put buffers cleanup path of iio hw consumer alloc(), the code was using list for each entry() to iterate through buffers while calling iio buffer put() which can free the current buffer if refcount drops to 0. The list for each entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer.

Fix this by using list for each entry safe().

Fix

Related Identifiers

CVE-2026-63930

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-63930 · Security Note
• https://git.kernel.org/stable/c/6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4 · Note
• https://git.kernel.org/stable/c/b71893c57730809c222766e5718bb33610f11963 · Note
• https://git.kernel.org/stable/c/9319c94f63ed10723afd738d79f5617daba87cc8 · Note
• https://git.kernel.org/stable/c/29783e6b6ec0b7152a15e53a063f17537e81177d · Note
• https://git.kernel.org/stable/c/d2759d49860b9a39b5cde2fb88e4b822ddf5f58f · Note
• https://git.kernel.org/stable/c/2ff615fc455acda5425c4900160cbe11cfea4449 · Note
• https://git.kernel.org/stable/c/e965627f0d442bfcae3f496c90cb653fb0917a61 · Note
• https://git.kernel.org/stable/c/a3763ae33476328cf8d661742deb9daec78eac96 · Note