CVE-2026-89938

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF

The atlas driver requests its hardware data-ready IRQ with

devm_request_threaded_irq(); its threaded handler queues an irq_work,

atlas_work_handler(), that calls iio_trigger_poll(data->trig).

The IRQ is devm-managed, so free_irq() runs from the devres unwind after

atlas_remove() returns without flushing that irq_work. Once a buffer is

enabled, conversion-complete IRQs keep firing and queueing it; a pending

irq_work can therefore run after the unwind has freed atlas_data/indio_dev

and the trigger, when atlas_work_handler() derives the atlas_data pointer

via container_of() and dereferences data->trig, a use-after-free.

Call iio_trigger_poll_nested() directly from the threaded handler instead

of bouncing through irq_work. free_irq() then drains the threaded handler,

closing the window; other iio drivers with a threaded data-ready IRQ do the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References