CVE-2026-64496

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iio: event: Fix event FIFO reset race

`iio_event_getfd()` creates the event file descriptor with

`anon_inode_getfd()`, which allocates a new fd, creates the anonymous

file and installs it in the process fd table before returning to the

caller.

The IIO code resets the event FIFO after `anon_inode_getfd()` has returned,

but before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace.

But since fd tables are shared between threads, another thread can guess

the newly allocated fd number and issue a `read()` on it as soon as the fd

has been installed.

This means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in

parallel with the `kfifo_reset_out()` in `iio_event_getfd()`.

The kfifo documentation says that `kfifo_reset_out()` is only safe when it

is called from the reader thread and there is only one concurrent reader.

Otherwise it is dangerous and must be handled in the same way as

`kfifo_reset()`

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References