In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: serialize buffer teardown with mode claims

Buffer-mode claims hold mlock to guarantee that the device remains in buffer mode until the claim is released. Normal buffer updates take info exist lock followed by mlock in iio update buffers().

However, iio device unregister() disables and deactivates all buffers without taking mlock. This can invalidate buffer state, including active scan mask, while a buffer-mode claim is held.

Take mlock in iio disable all buffers() so that unregister honors the mode-claim lifetime guarantee. The info exist lock -> mlock ordering matches iio update buffers().