CVE-2026-64496

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the Industrial I/O (IIO) event handling. The function iio event getfd() uses anon inode getfd() to create an event file descriptor, which is installed in the process fd table before the event FIFO is reset. Because fd tables are shared between threads, a concurrent thread could guess the new fd number and perform a read() operation. This allows kfifo to user() in iio event chrdev read() to execute in parallel with kfifo reset out() in iio event getfd(). This concurrency can cause the FIFO out index to advance past the in index, leading to an underflowed FIFO length. Consequently, a subsequent read() may copy more data than the buffer contains, resulting in an out-of-bounds read that leaks adjacent kernel memory to userspace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.