NetSight
IP …
high7.8

CVE-2026-63930

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup p…

Impact

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer. Fix this by using list_for_each_entry_safe().

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.16 before 5.10.259
from 5.11 before 5.15.210
from 5.16 before 6.1.176
from 6.2 before 6.6.143
from 6.7 before 6.12.93
from 6.13 before 6.18.35

Weakness classification

CWE-416

References