What’s Vulnerable › Vulnerabilities

CVE-2026-64498: iio: buffer: hw-consumer: free scan_mask on buffer release

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-25 · updated 2026-08-17

Description

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scan_mask on buffer release The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer: hw-consumer: remove redundant scan_mask flexible array"). Before that change, the scan mask storage was embedded in struct hw_consumer_buffer, so iio_hw_buf_release() could free the whole allocation with a single kfree(hw_buf). That commit moved the scan mask to a separate bitmap_zalloc() allocation stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged. Free the scan mask in iio_hw_buf_release() before freeing the buffer wrapper.

Affected products

• Linux kernel: 7.1 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/6325d6e2204327965b849c0a16efb6ac9202e5a8
• https://git.kernel.org/stable/c/fb8e18f8ca724bd4de4643cad5b7c7230b9a5a71

Get alerted when CVE-2026-64498 or the next vulnerability affects your stack