In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: Tie IIO dma fence lock lifetime to the fence
The iio_dma_fence implementation currently uses a lock embedded in the
iio_dmabuf_priv. But the iio_dma_fence can outlive the
iio_dmabuf_priv, which can cause a use-after-free.
Tie the lifetime of the lock to the lifetime of the fence by embedding them
in the same struct.
We can't just hold a reference to the iio_dmabuf_priv from the
iio_dma_fence since iio_buffer_dmabuf_release() might sleep and the
fence release callback is not allowed to sleep.
Note that the dma_fence framework now has an internal lock that gets used
when the passing NULL for lock in dma_fence_init(), but in order to
allow this patch to be backportable use an external lock.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The use-after-free is reached through local IIO_BUFFER_DMABUF_ATTACH/ENQUEUE/DETACH ioctls on an anonymous iio:buffer fd from IIO_BUFFER_GET_FD_IOCTL on /dev/iio:deviceN; it is not reachable from network packet processing or adjacent-link protocols.
AC:L - The attacker fully controls the lifetime mismatch: they attach and enqueue a DMA-BUF so the dma_fence lock lives in iio_dmabuf_priv, then detach so priv is freed while the fence remains in the DMA-BUF reservation, and later DMA_BUF_IOCTL_SYNC/wait takes that freed lock.
PR:L - The IIO open and ioctl path has no capability check, only filesystem access to the device node. On Android phones, industrial converters, and embedded systems exposing this DMA-BUF buffer API, /dev/iio:device* is commonly group-accessible without init-namespace root.
UI:N - The attacker opens the IIO device, issues the DMA-BUF attach/enqueue/detach ioctls, and waits on their own DMA-BUF file descriptor; no separate victim action is required.
S:U - This is a standard in-kernel heap use-after-free of iio_dmabuf_priv within the host kernel's security authority, not a VM escape, IOMMU boundary bypass, or sandbox escape.
C:H - The dma_fence retains a pointer to a spinlock embedded in freed iio_dmabuf_priv; later fence wait/sync operations use that lock, a slab use-after-free that can be turned into an arbitrary kernel memory read via heap spraying.
I:H - The same use-after-free of iio_dmabuf_priv lets an attacker reclaim the object and corrupt dma_fence lock and callback state during later wait or signaling paths, enabling heap corruption, arbitrary write, and control-flow hijacking.
A:H - Taking a spinlock in already-freed iio_dmabuf_priv memory causes a kernel oops, BUG, or panic; any use-after-free is high availability impact even when not fully exploited.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The use-after-free is reached through local IIO_BUFFER_DMABUF_ATTACH/ENQUEUE/DETACH ioctls on an anonymous iio:buffer fd from IIO_BUFFER_GET_FD_IOCTL on /dev/iio:deviceN; it is not reachable from network packet processing or adjacent-link protocols.
AC:L - The attacker fully controls the lifetime mismatch: they attach and enqueue a DMA-BUF so the dma_fence lock lives in iio_dmabuf_priv, then detach so priv is freed while the fence remains in the DMA-BUF reservation, and later DMA_BUF_IOCTL_SYNC/wait takes that freed lock.
PR:L - The IIO open and ioctl path has no capability check, only filesystem access to the device node. On Android phones, industrial converters, and embedded systems exposing this DMA-BUF buffer API, /dev/iio:device* is commonly group-accessible without init-namespace root.
UI:N - The attacker opens the IIO device, issues the DMA-BUF attach/enqueue/detach ioctls, and waits on their own DMA-BUF file descriptor; no separate victim action is required.
S:U - This is a standard in-kernel heap use-after-free of iio_dmabuf_priv within the host kernel's security authority, not a VM escape, IOMMU boundary bypass, or sandbox escape.
C:H - The dma_fence retains a pointer to a spinlock embedded in freed iio_dmabuf_priv; later fence wait/sync operations use that lock, a slab use-after-free that can be turned into an arbitrary kernel memory read via heap spraying.
I:H - The same use-after-free of iio_dmabuf_priv lets an attacker reclaim the object and corrupt dma_fence lock and callback state during later wait or signaling paths, enabling heap corruption, arbitrary write, and control-flow hijacking.
A:H - Taking a spinlock in already-freed iio_dmabuf_priv memory causes a kernel oops, BUG, or panic; any use-after-free is high availability impact even when not fully exploited.
CVSS 3.1