CVE-2026-98669

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: serialize buffer teardown with mode claims

Buffer-mode claims hold mlock to guarantee that the device remains in

buffer mode until the claim is released. Normal buffer updates take

info_exist_lock followed by mlock in iio_update_buffers().

However, iio_device_unregister() disables and deactivates all buffers

without taking mlock. This can invalidate buffer state, including

active_scan_mask, while a buffer-mode claim is held.

Take mlock in iio_disable_all_buffers() so that unregister honors the

mode-claim lifetime guarantee. The info_exist_lock -> mlock ordering

matches iio_update_buffers().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References