CVE-2026-64498 is a vulnerability in Linux Kernel
Published on July 25, 2026
iio: buffer: hw-consumer: free scan_mask on buffer release
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: hw-consumer: free scan_mask on buffer release
The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer:
hw-consumer: remove redundant scan_mask flexible array").
Before that change, the scan mask storage was embedded in struct
hw_consumer_buffer, so iio_hw_buf_release() could free the whole
allocation with a single kfree(hw_buf).
That commit moved the scan mask to a separate bitmap_zalloc() allocation
stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged.
Free the scan mask in iio_hw_buf_release() before freeing the buffer
wrapper.
Products Associated with CVE-2026-64498
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 9a2e1233d38c460ad07f36901931f3674a32d1ed and below fb8e18f8ca724bd4de4643cad5b7c7230b9a5a71 is affected.
- Version 9a2e1233d38c460ad07f36901931f3674a32d1ed and below 6325d6e2204327965b849c0a16efb6ac9202e5a8 is affected.
- Version 7.1 is affected.
- Before 7.1 is unaffected.
- Version 7.1.4, <= 7.1.* is unaffected.
- Version 7.2-rc1, <= * is unaffected.