CVE-2026-63930
Received Received - Intake

Buffer Use-After-Free in Linux Kernel IIO Hardware Consumer

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer. Fix this by using list_for_each_entry_safe().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63930
EUVD
EUVD-2026-45703

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's IIO (Industrial I/O) subsystem. It occurs in the error handling path of iio_hw_consumer_alloc() where a list iteration continues after a buffer is freed, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's IIO (Industrial I/O) subsystem and relates to a use-after-free issue in the hw-consumer buffer handling. Detection requires checking the kernel version and verifying if the vulnerable code path exists in the running kernel. Use uname -a to check the kernel version and grep for the affected function in the kernel source or running system.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior if exploited. It may lead to denial-of-service conditions or privilege escalation in systems running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's IIO buffer handling, which could lead to memory corruption or crashes. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the use-after-free issue in the IIO hw-consumer buffer handling. If an update is not immediately available, consider disabling the IIO hw-consumer functionality if not required, or restrict access to affected systems until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63930. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart