CVE-2025-38485: iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-28 · updated 2026-07-30
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush fxls8962af_fifo_flush() uses indio_dev->active_scan_mask (with iio_for_each_active_channel()) without making sure the indio_dev stays in buffer mode. There is a race if indio_dev exits buffer mode in the middle of the interrupt that flushes the fifo. Fix this by calling synchronize_irq() to ensure that no interrupt is currently running when disabling buffer mode. Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [...] _find_first_bit_le from fxls8962af_fifo_flush+0x17c/0x290 fxls8962af_fifo_flush from fxls8962af_interrupt+0x80/0x178 fxls8962af_interrupt from irq_thread_fn+0x1c/0x7c irq_thread_fn from irq_thread+0x110/0x1f4 irq_thread from kthread+0xe0/0xfc kthread from ret_from_fork+0x14/0x2c

Affected products

Debian Linux: 11.0
Linux kernel: from 5.14 before 6.1.147; from 6.2 before 6.6.100; from 6.7 before 6.12.40; from 6.13 before 6.15.8; 6.16-rc1, 6.16-rc2, 6.16-rc3, 6.16-rc4, 6.16-rc5, 6.16-rc6 — fixed in 6.1.147, 6.12.40, 6.15.8, 6.6.100

How to fix

Upgrade to a fixed version: Linux kernel 6.1.147, 6.12.40, 6.15.8, 6.6.100. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-38485 or the next vulnerability affects your stack