Vulnerability-Lookup

CVE-2026-64496 (GCVE-0-2026-64496)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51

Title

iio: event: Fix event FIFO reset race

Summary

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race `iio_event_getfd()` creates the event file descriptor with `anon_inode_getfd()`, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the caller. The IIO code resets the event FIFO after `anon_inode_getfd()` has returned, but before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace. But since fd tables are shared between threads, another thread can guess the newly allocated fd number and issue a `read()` on it as soon as the fd has been installed. This means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in parallel with the `kfifo_reset_out()` in `iio_event_getfd()`. The kfifo documentation says that `kfifo_reset_out()` is only safe when it is called from the reader thread and there is only one concurrent reader. Otherwise it is dangerous and must be handled in the same way as `kfifo_reset()`. If that happens, `kfifo_to_user()` can advance the FIFO `out` index based on state from before the reset, after the reset has already moved the `out` index to the current `in` index. That can leave the FIFO with an `out` index past the `in` index. A later `read()` can then see an underflowed FIFO length and copy more data than the event FIFO buffer contains. This can result in an out-of-bounds read and leak adjacent kernel memory to userspace. Move the FIFO reset before `anon_inode_getfd()`. At that point the event fd is marked busy, but the new fd has not been installed yet, so userspace cannot access it while the FIFO is reset.

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/9dc84ba4be5bbeb29…
https://git.kernel.org/stable/c/d16a702ca7d29c0b7…
https://git.kernel.org/stable/c/a13ef1adbc62085b2…
https://git.kernel.org/stable/c/0d4a646d7f87ea362…
https://git.kernel.org/stable/c/72c6aa8e0d74eab91…
https://git.kernel.org/stable/c/9edefd4c56bee3fe3…
https://git.kernel.org/stable/c/f187dc5a4c4846ffa…
https://git.kernel.org/stable/c/af791d295737ea6b6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < 9dc84ba4be5bbeb29ee49efe6cea2cb32c461424 (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < d16a702ca7d29c0b7a9b509339d1b044a1cadb32 (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < a13ef1adbc62085b21b546b07b0be7e2fbf52150 (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < 0d4a646d7f87ea3625fafe387043fddc6a2f5e7f (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < 72c6aa8e0d74eab91b8694cde97dec088c248fee (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < 9edefd4c56bee3fe331e0355d1f10a533134999d (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < f187dc5a4c4846ffa07d9bda6e760837ed005574 (git) Affected: b91accafbb1031b80d22ad83576877ff2f8b4774 , < af791d295737ea6b6ff2c8d8488462a49c14af01 (git)
Linux	Linux	Affected: 3.15 Unaffected: 0 , < 3.15 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/industrialio-event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9dc84ba4be5bbeb29ee49efe6cea2cb32c461424",
              "status": "affected",
              "version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
              "versionType": "git"
            },
            {
              "lessThan": "d16a702ca7d29c0b7a9b509339d1b044a1cadb32",
              "status": "affected",
              "version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
              "versionType": "git"
            },
            {
              "lessThan": "a13ef1adbc62085b21b546b07b0be7e2fbf52150",
              "status": "affected",
              "version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
              "versionType": "git"
            },
            {
              "lessThan": "0d4a646d7f87ea3625fafe387043fddc6a2f5e7f",
              "status": "affected",
              "version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
              "versionType": "git"
            },
            {
              "lessThan": "72c6aa8e0d74eab91b8694cde97dec088c248fee",
              "status": "affected",
              "version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
              "versionType": "git"
            },
            {
              "lessThan": "9edefd4c56bee3fe331e0355d1f10a533134999d",
              "status": "affected",
              "version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
              "versionType": "git"
            },
            {
              "lessThan": "f187dc5a4c4846ffa07d9bda6e760837ed005574",
              "status": "affected",
              "version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
              "versionType": "git"
            },
            {
              "lessThan": "af791d295737ea6b6ff2c8d8488462a49c14af01",
              "status": "affected",
              "version": "b91accafbb1031b80d22ad83576877ff2f8b4774",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/industrialio-event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: event: Fix event FIFO reset race\n\n`iio_event_getfd()` creates the event file descriptor with\n`anon_inode_getfd()`, which allocates a new fd, creates the anonymous\nfile and installs it in the process fd table before returning to the\ncaller.\n\nThe IIO code resets the event FIFO after `anon_inode_getfd()` has returned,\nbut before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace.\nBut since fd tables are shared between threads, another thread can guess\nthe newly allocated fd number and issue a `read()` on it as soon as the fd\nhas been installed.\n\nThis means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in\nparallel with the `kfifo_reset_out()` in `iio_event_getfd()`.\n\nThe kfifo documentation says that `kfifo_reset_out()` is only safe when it\nis called from the reader thread and there is only one concurrent reader.\nOtherwise it is dangerous and must be handled in the same way as\n`kfifo_reset()`.\n\nIf that happens, `kfifo_to_user()` can advance the FIFO `out` index based\non state from before the reset, after the reset has already moved the `out`\nindex to the current `in` index. That can leave the FIFO with an `out`\nindex past the `in` index. A later `read()` can then see an underflowed\nFIFO length and copy more data than the event FIFO buffer contains. This\ncan result in an out-of-bounds read and leak adjacent kernel memory to\nuserspace.\n\nMove the FIFO reset before `anon_inode_getfd()`. At that point the event fd is\nmarked busy, but the new fd has not been installed yet, so userspace cannot\naccess it while the FIFO is reset."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-25T08:51:53.194Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9dc84ba4be5bbeb29ee49efe6cea2cb32c461424"
        },
        {
          "url": "https://git.kernel.org/stable/c/d16a702ca7d29c0b7a9b509339d1b044a1cadb32"
        },
        {
          "url": "https://git.kernel.org/stable/c/a13ef1adbc62085b21b546b07b0be7e2fbf52150"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d4a646d7f87ea3625fafe387043fddc6a2f5e7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/72c6aa8e0d74eab91b8694cde97dec088c248fee"
        },
        {
          "url": "https://git.kernel.org/stable/c/9edefd4c56bee3fe331e0355d1f10a533134999d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f187dc5a4c4846ffa07d9bda6e760837ed005574"
        },
        {
          "url": "https://git.kernel.org/stable/c/af791d295737ea6b6ff2c8d8488462a49c14af01"
        }
      ],
      "title": "iio: event: Fix event FIFO reset race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64496",
    "datePublished": "2026-07-25T08:51:53.194Z",
    "dateReserved": "2026-07-19T15:36:31.792Z",
    "dateUpdated": "2026-07-25T08:51:53.194Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64496",
      "date": "2026-07-26",
      "epss": "0.00177",
      "percentile": "0.07529"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64496\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:35.490\",\"lastModified\":\"2026-07-25T10:17:35.490\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niio: event: Fix event FIFO reset race\\n\\n`iio_event_getfd()` creates the event file descriptor with\\n`anon_inode_getfd()`, which allocates a new fd, creates the anonymous\\nfile and installs it in the process fd table before returning to the\\ncaller.\\n\\nThe IIO code resets the event FIFO after `anon_inode_getfd()` has returned,\\nbut before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace.\\nBut since fd tables are shared between threads, another thread can guess\\nthe newly allocated fd number and issue a `read()` on it as soon as the fd\\nhas been installed.\\n\\nThis means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in\\nparallel with the `kfifo_reset_out()` in `iio_event_getfd()`.\\n\\nThe kfifo documentation says that `kfifo_reset_out()` is only safe when it\\nis called from the reader thread and there is only one concurrent reader.\\nOtherwise it is dangerous and must be handled in the same way as\\n`kfifo_reset()`.\\n\\nIf that happens, `kfifo_to_user()` can advance the FIFO `out` index based\\non state from before the reset, after the reset has already moved the `out`\\nindex to the current `in` index. That can leave the FIFO with an `out`\\nindex past the `in` index. A later `read()` can then see an underflowed\\nFIFO length and copy more data than the event FIFO buffer contains. This\\ncan result in an out-of-bounds read and leak adjacent kernel memory to\\nuserspace.\\n\\nMove the FIFO reset before `anon_inode_getfd()`. At that point the event fd is\\nmarked busy, but the new fd has not been installed yet, so userspace cannot\\naccess it while the FIFO is reset.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iio/industrialio-event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b91accafbb1031b80d22ad83576877ff2f8b4774\",\"lessThan\":\"9dc84ba4be5bbeb29ee49efe6cea2cb32c461424\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b91accafbb1031b80d22ad83576877ff2f8b4774\",\"lessThan\":\"d16a702ca7d29c0b7a9b509339d1b044a1cadb32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b91accafbb1031b80d22ad83576877ff2f8b4774\",\"lessThan\":\"a13ef1adbc62085b21b546b07b0be7e2fbf52150\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b91accafbb1031b80d22ad83576877ff2f8b4774\",\"lessThan\":\"0d4a646d7f87ea3625fafe387043fddc6a2f5e7f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b91accafbb1031b80d22ad83576877ff2f8b4774\",\"lessThan\":\"72c6aa8e0d74eab91b8694cde97dec088c248fee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b91accafbb1031b80d22ad83576877ff2f8b4774\",\"lessThan\":\"9edefd4c56bee3fe331e0355d1f10a533134999d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b91accafbb1031b80d22ad83576877ff2f8b4774\",\"lessThan\":\"f187dc5a4c4846ffa07d9bda6e760837ed005574\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b91accafbb1031b80d22ad83576877ff2f8b4774\",\"lessThan\":\"af791d295737ea6b6ff2c8d8488462a49c14af01\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iio/industrialio-event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0d4a646d7f87ea3625fafe387043fddc6a2f5e7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/72c6aa8e0d74eab91b8694cde97dec088c248fee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9dc84ba4be5bbeb29ee49efe6cea2cb32c461424\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9edefd4c56bee3fe331e0355d1f10a533134999d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a13ef1adbc62085b21b546b07b0be7e2fbf52150\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af791d295737ea6b6ff2c8d8488462a49c14af01\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d16a702ca7d29c0b7a9b509339d1b044a1cadb32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f187dc5a4c4846ffa07d9bda6e760837ed005574\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-07-25T15:58:16Z",
      "cve": "CVE-2026-64496",
      "id": "CVE-2026-64496",
      "initial_release_date": "2026-07-25T15:58:16Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64496",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64496.json",
      "version": "2"
    }
  }
}

GHSA-HH3R-JGC6-QR6Q

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-25 12:31

Details

In the Linux kernel, the following vulnerability has been resolved:

iio: event: Fix event FIFO reset race

iio_event_getfd() creates the event file descriptor with anon_inode_getfd(), which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the caller.

The IIO code resets the event FIFO after anon_inode_getfd() has returned, but before IIO_GET_EVENT_FD_IOCTL has copied the fd number to userspace. But since fd tables are shared between threads, another thread can guess the newly allocated fd number and issue a read() on it as soon as the fd has been installed.

This means the kfifo_to_user() in iio_event_chrdev_read() can run in parallel with the kfifo_reset_out() in iio_event_getfd().

The kfifo documentation says that kfifo_reset_out() is only safe when it is called from the reader thread and there is only one concurrent reader. Otherwise it is dangerous and must be handled in the same way as kfifo_reset().

If that happens, kfifo_to_user() can advance the FIFO out index based on state from before the reset, after the reset has already moved the out index to the current in index. That can leave the FIFO with an out index past the in index. A later read() can then see an underflowed FIFO length and copy more data than the event FIFO buffer contains. This can result in an out-of-bounds read and leak adjacent kernel memory to userspace.

Move the FIFO reset before anon_inode_getfd(). At that point the event fd is marked busy, but the new fd has not been installed yet, so userspace cannot access it while the FIFO is reset.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64496"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:35Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: event: Fix event FIFO reset race\n\n`iio_event_getfd()` creates the event file descriptor with\n`anon_inode_getfd()`, which allocates a new fd, creates the anonymous\nfile and installs it in the process fd table before returning to the\ncaller.\n\nThe IIO code resets the event FIFO after `anon_inode_getfd()` has returned,\nbut before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace.\nBut since fd tables are shared between threads, another thread can guess\nthe newly allocated fd number and issue a `read()` on it as soon as the fd\nhas been installed.\n\nThis means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in\nparallel with the `kfifo_reset_out()` in `iio_event_getfd()`.\n\nThe kfifo documentation says that `kfifo_reset_out()` is only safe when it\nis called from the reader thread and there is only one concurrent reader.\nOtherwise it is dangerous and must be handled in the same way as\n`kfifo_reset()`.\n\nIf that happens, `kfifo_to_user()` can advance the FIFO `out` index based\non state from before the reset, after the reset has already moved the `out`\nindex to the current `in` index. That can leave the FIFO with an `out`\nindex past the `in` index. A later `read()` can then see an underflowed\nFIFO length and copy more data than the event FIFO buffer contains. This\ncan result in an out-of-bounds read and leak adjacent kernel memory to\nuserspace.\n\nMove the FIFO reset before `anon_inode_getfd()`. At that point the event fd is\nmarked busy, but the new fd has not been installed yet, so userspace cannot\naccess it while the FIFO is reset.",
  "id": "GHSA-hh3r-jgc6-qr6q",
  "modified": "2026-07-25T12:31:38Z",
  "published": "2026-07-25T12:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64496"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0d4a646d7f87ea3625fafe387043fddc6a2f5e7f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/72c6aa8e0d74eab91b8694cde97dec088c248fee"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9dc84ba4be5bbeb29ee49efe6cea2cb32c461424"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9edefd4c56bee3fe331e0355d1f10a533134999d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a13ef1adbc62085b21b546b07b0be7e2fbf52150"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/af791d295737ea6b6ff2c8d8488462a49c14af01"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d16a702ca7d29c0b7a9b509339d1b044a1cadb32"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f187dc5a4c4846ffa07d9bda6e760837ed005574"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-64496 (GCVE-0-2026-64496)

GHSA-HH3R-JGC6-QR6Q

Tags

Sightings

Nomenclature