CVE-2026-63929

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()

iio_buffer_enqueue_dmabuf() allocates a struct iio_dma_fence (104 bytes,

kmalloc-128) via kmalloc_obj()+dma_fence_init(), which sets the initial

kref to 1. It then calls dma_resv_add_fence() which takes a second

reference (kref=2), and stores a raw pointer in block->fence.

On the success path the function returns without calling dma_fence_put()

to release the initial reference, so every buffer enqueue permanently

leaks one kmalloc-128 allocation.

The iio_buffer_cleanup() work item only releases the temporary reference

taken during completion signalling by iio_buffer_signal_dmabuf_done();

the initial reference from dma_fence_init() is never released.

With four iio_rwdev instances at 240kHz and 512 samples per buffer,

this produces ~1875 kmalloc-128 allocations per second matching the

observed slab growth exactly. A test with ftrace confirmed that the

d

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References