CVE-2026-89938

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the atlas-sensor driver within the industrial I/O (IIO) chemical subsystem. The driver uses devm request threaded irq() to request hardware data-ready interrupts, and its threaded handler queues an irq work via the atlas work handler() function, which subsequently calls iio trigger poll(). Because the interrupt is managed by the device resource manager (devres), free irq() is executed after atlas remove() returns, but without flushing the pending irq work. If a buffer is enabled, conversion-complete interrupts may continue to queue work that executes after the atlas data, indio dev, and trigger have been freed. This leads to a use-after-free when atlas work handler() attempts to dereference the data->trig pointer.

Recommendations As a temporary mitigation, restrict the use of the atlas-sensor driver until the system is updated. Update the kernel to a version where the threaded handler calls iio trigger poll nested() directly instead of using irq work.