{"id":"CVE-2026-98669","kind":"vulnerability","aliases":["CVE-2026-98669"],"related":[],"title":"Linux kernel IIO: buffer teardown can race active mode claims on unregister","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: serialize buffer teardown with mode claims\n\nBuffer-mode claims hold mlock to guarantee that the device remains in\nbuffer mode until the claim is released. Normal buffer updates take\ninfo_exist_lock followed by mlock in iio_update_buffers().\n\nHowever, iio_device_unregister() disables and deactivates all buffers\nwithout taking mlock. This can invalidate buffer state, including\nactive_scan_mask, while a buffer-mode claim is held.\n\nTake mlock in iio_disable_all_buffers() so that unregister honors the\nmode-claim lifetime guarantee. The info_exist_lock -> mlock ordering\nmatches iio_update_buffers().","summary":"In the Linux kernel's Industrial I/O (IIO) subsystem, unregistering a device disables and deactivates its buffers without holding the mode lock, so buffer state can change while a buffer-mode claim is held. The sources do not describe a concrete attacker-reachable impact.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iio","linux-kernel","runtime"],"not_affected_if":["no-iio-devices"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit 'iio: buffer: serialize buffer teardown with mode claims' (kernel version unknown from sources)","status":"open","published_at":"2026-10-18T16:17:20+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:23+00:00","updated_at":"2026-10-25T05:19:23+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:19:23Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'iio: buffer: serialize buffer teardown with mode claims' (kernel version unknown from sources)","reach":"local","title":"Linux kernel IIO: buffer teardown can race active mode claims on unregister","impact":"low","summary":"In the Linux kernel's Industrial I/O (IIO) subsystem, unregistering a device disables and deactivates its buffers without holding the mode lock, so buffer state can change while a buffer-mode claim is held. The sources do not describe a concrete attacker-reachable impact.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","iio","embedded"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown: sources describe a state race, not a confirmed exploit","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected version range and any demonstrated impact.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-iio-devices"],"who_is_affected":"Systems running a Linux kernel with IIO sensor or ADC drivers loaded, where devices can be unregistered while buffers are in use. Systems without IIO hardware or drivers are unlikely to be affected. The sources do not say more.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000596,"input_tokens":3465,"output_tokens":499,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98669':15A,18A 'activ':8A,141C 'attack':68B 'attacker-reach':67B 'buffer':4A,41B,48B,55B,82C,84C,90C,102C,110C,122C,131C,138C,147C,158C,178C 'buffer-mod':54B,89C,146C 'chang':51B 'claim':10A,57B,88C,92C,106C,149C,166C 'concret':66B 'cve':13A,16A 'deactiv':39B,129C 'describ':64B 'devic':36B,99C,125C 'disabl':37B,127C,156C 'embed':19B 'exist':114C,171C 'follow':76C,116C 'guarante':96C,168C 'held':59B,151C 'hold':43B,93C 'honor':162C 'howev':123C 'i/o':31B 'iio':3A,20B,32B,81C,120C,124C,155C,176C 'impact':70B 'includ':140C 'industri':30B 'info':113C,170C 'invalid':137C 'kernel':2A,23B,28B,74C 'lifetim':167C 'linux':1A,22B,27B,73C 'linux-kernel':21B 'lock':46B,115C,172C 'mask':143C 'match':175C 'mlock':94C,118C,134C,153C,173C 'mode':9A,45B,56B,87C,91C,103C,148C,165C 'mode-claim':164C 'normal':109C 'order':174C 'race':7A 'reachabl':69B 'releas':108C 'remain':100C 'resolv':80C 'runtim':24B 'scan':142C 'serial':83C 'sourc':61B 'state':49B,139C 'subsystem':33B 'take':112C,133C,152C 'teardown':5A,85C 'unregist':12A,34B,126C,161C 'updat':111C,121C,177C 'vulner':77C 'without':42B,132C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with IIO sensor or ADC drivers loaded, where devices can be unregistered while buffers are in use. Systems without IIO hardware or drivers are unlikely to be affected. The sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98669","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98669","severity":null,"published_at":"2026-10-18T16:17:20+00:00","modified_at":"2026-10-21T13:21:36+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}