CVE-2026-98669
Received Received - Intake

Buffer Mode Claim Race Condition in Linux Kernel IIO Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: serialize buffer teardown with mode claims Buffer-mode claims hold mlock to guarantee that the device remains in buffer mode until the claim is released. Normal buffer updates take info_exist_lock followed by mlock in iio_update_buffers(). However, iio_device_unregister() disables and deactivates all buffers without taking mlock. This can invalidate buffer state, including active_scan_mask, while a buffer-mode claim is held. Take mlock in iio_disable_all_buffers() so that unregister honors the mode-claim lifetime guarantee. The info_exist_lock -> mlock ordering matches iio_update_buffers().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98669
EUVD
EUVD-2026-103923

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 0a8565425afd8ba0e1a0ea73e21da119ee6dacea
Linux Linux 0a8565425afd8ba0e1a0ea73e21da119ee6dacea
Linux Linux 0a8565425afd8ba0e1a0ea73e21da119ee6dacea
Linux Linux 0a8565425afd8ba0e1a0ea73e21da119ee6dacea
Linux Linux a9c471892d75847671a246619c2148578f22bbc6
Linux Linux 7bca0af538a49dacb1470f233be0676bdc09605b
Linux Linux 5.15.137
Linux Linux 6.1.60
Linux Linux 6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of buffer-mode claims during device unregistration. Normally, buffer updates use info_exist_lock followed by mlock to ensure device stability. However, iio_device_unregister() disables buffers without taking mlock, potentially invalidating buffer state while a claim is active.

Impact Analysis

This flaw could lead to system instability or crashes if buffer states are corrupted while in use. It may cause unexpected behavior in applications relying on IIO (Industrial I/O) subsystems, such as sensors or data acquisition devices.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98669. This vulnerability affects the IIO buffer subsystem, so ensure your kernel version includes the commit addressing the buffer teardown race condition.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98669. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart