---
id: CVE-2026-98669
title: 'iio: buffer: serialize buffer teardown with mode claims'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iio: buffer: serialize buffer teardown with mode claims

  Buffer-mode claims hold mlock to guarantee that the device remains in
  buffer mode until the claim is released. …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0a8565425afd8ba0e1a0ea73e21da119ee6dacea <
    89f3852a28fcf7bab599280cb082baa0675536db
  - >-
    Linux >= 0a8565425afd8ba0e1a0ea73e21da119ee6dacea <
    b466db9e68b4741af85f6c017e2bb0a2f025053f
  - >-
    Linux >= 0a8565425afd8ba0e1a0ea73e21da119ee6dacea <
    e63188d77e10c0951bf67da6c295f768fd1abf4b
  - >-
    Linux >= 0a8565425afd8ba0e1a0ea73e21da119ee6dacea <
    84bb0fc46ccf6a545b8fdf57cda83770186ed8dd
  - Linux a9c471892d75847671a246619c2148578f22bbc6
  - Linux 7bca0af538a49dacb1470f233be0676bdc09605b
  - Linux >= 5.15.137 < 5.16
  - Linux >= 6.1.60 < 6.2
  - Linux 6.2
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:45:05.836Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98669'
references:
  - url: 'https://git.kernel.org/stable/c/89f3852a28fcf7bab599280cb082baa0675536db'
  - url: 'https://git.kernel.org/stable/c/b466db9e68b4741af85f6c017e2bb0a2f025053f'
  - url: 'https://git.kernel.org/stable/c/e63188d77e10c0951bf67da6c295f768fd1abf4b'
  - url: 'https://git.kernel.org/stable/c/84bb0fc46ccf6a545b8fdf57cda83770186ed8dd'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.533Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: serialize buffer teardown with mode claims

Buffer-mode claims hold mlock to guarantee that the device remains in
buffer mode until the claim is released. Normal buffer updates take
info_exist_lock followed by mlock in iio_update_buffers().

However, iio_device_unregister() disables and deactivates all buffers
without taking mlock. This can invalidate buffer state, including
active_scan_mask, while a buffer-mode claim is held.

Take mlock in iio_disable_all_buffers() so that unregister honors the
mode-claim lifetime guarantee. The info_exist_lock -> mlock ordering
matches iio_update_buffers().

## Affected

- `Linux >= 0a8565425afd8ba0e1a0ea73e21da119ee6dacea < 89f3852a28fcf7bab599280cb082baa0675536db`
- `Linux >= 0a8565425afd8ba0e1a0ea73e21da119ee6dacea < b466db9e68b4741af85f6c017e2bb0a2f025053f`
- `Linux >= 0a8565425afd8ba0e1a0ea73e21da119ee6dacea < e63188d77e10c0951bf67da6c295f768fd1abf4b`
- `Linux >= 0a8565425afd8ba0e1a0ea73e21da119ee6dacea < 84bb0fc46ccf6a545b8fdf57cda83770186ed8dd`
- `Linux a9c471892d75847671a246619c2148578f22bbc6`
- `Linux 7bca0af538a49dacb1470f233be0676bdc09605b`
- `Linux >= 5.15.137 < 5.16`
- `Linux >= 6.1.60 < 6.2`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.