SECUFOCUSNOW
Home›CVE index›CVE-2026-63930
Review reviewHigh

CVE-2026-63930

Linux

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer. Fix this by using list_for_each_entry_safe().

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer. Fix this by using list_for_each_entry_safe().

Affected product and versions

Product
Linux
Affected versions
>= 48b66f8f936f369bb1a43c12aedbfeb2975baf4c < b71893c57730809c222766e5718bb33610f11963, >= 48b66f8f936f369bb1a43c12aedbfeb2975baf4c < 2ff615fc455acda5425c4900160cbe11cfea4449, >= 48b66f8f936f369bb1a43c12aedbfeb2975baf4c < d2759d49860b9a39b5cde2fb88e4b822ddf5f58f, >= 48b66f8f936f369bb1a43c12aedbfeb2975baf4c < 29783e6b6ec0b7152a15e53a063f17537e81177d, >= 48b66f8f936f369bb1a43c12aedbfeb2975baf4c < e965627f0d442bfcae3f496c90cb653fb0917a61, >= 48b66f8f936f369bb1a43c12aedbfeb2975baf4c < a3763ae33476328cf8d661742deb9daec78eac96, >= 48b66f8f936f369bb1a43c12aedbfeb2975baf4c < 9319c94f63ed10723afd738d79f5617daba87cc8, >= 48b66f8f936f369bb1a43c12aedbfeb2975baf4c < 6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4, >= 4.16
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available