CVE-2026-98669

What it actually does

Race condition in Linux kernel IIO subsystem where iio_device_unregister() can invalidate active_scan_mask and other buffer state without holding mlock, violating the lifetime guarantee for buffer-mode claims that rely on mlock to keep the device in buffer mode.

Why it matters to the business

Linux systems using Industrial I/O devices for sensors or data acquisition may experience kernel crashes, memory corruption, or unexpected device behavior, leading to downtime or loss of sensor functionality in embedded, industrial, or scientific workloads.

How an attack unfolds

An attacker with local access triggers concurrent buffer-mode claims and device unregistration paths; by racing iio_update_buffers() against iio_disable_all_buffers() the attacker causes use of freed or inconsistent scan mask data, potentially escalating to kernel memory corruption.

How to fix it

Update to a Linux kernel containing the fix that acquires mlock inside iio_disable_all_buffers() to enforce the info_exist_lock → mlock ordering; rebuild and reboot affected systems with the patched kernel.

How to confirm the fix worked

Confirm the presence of the commit that adds mlock acquisition to iio_disable_all_buffers() and verify that iio_update_buffers() and unregister paths now share consistent lock ordering; test by exercising buffer claim and unregister sequences under concurrency.

Typical attack path

1. Obtain local code execution on a Linux system exposing IIO devices
2. Open and claim a buffer in a mode that acquires mlock
3. Trigger or race device unregistration or buffer teardown from another context
4. Exploit resulting invalid active_scan_mask or buffer state for memory corruption or denial of service

How to detect it

Review kernel crash logs and oops reports for IIO buffer teardown races; correlate timestamps of buffer open/close operations with device unregistration events in dmesg or audit logs.

What your security team should do

• Prioritize kernel updates for any Linux distribution or embedded image using the IIO subsystem
• Apply the fix within normal patch cycles unless the system exposes IIO devices to untrusted local users
• Monitor upstream stable kernel releases for backports of the buffer teardown serialization change