Race Condition in Linux Kernel's IIO Event Handling

CVE-2026-64496

What is CVE-2026-64496?

The vulnerability in the Linux kernel arises from a race condition during the IIO event FIFO reset process. When the event file descriptor is created, a newly allocated file descriptor can be exposed to multiple threads before proper synchronization is achieved. This timing issue permits a thread to read from the newly allocated file descriptor while another thread resets the FIFO, potentially leading to an out-of-bounds read. As a result, this can cause sensitive kernel memory to be leaked to user space, representing a serious security risk for systems utilizing affected versions of the Linux kernel.

References