CVE-2026-64498 iio: buffer: hw-consumer: free scan_mask on buffer release
A missing memory free in the Linux kernel IIO subsystem can lead to memory corruption, potentially allowing local attackers to escalate privileges or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64498?
CVE-2026-64498 is a memory corruption vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: buffer: hw-consumer: free scan_mask on buffer release
The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer: hw-consumer: remove redundant scan_mask flexible array").
Before that change, the scan mask storage was embedded in struct hw_consumer_buffer, so iio_hw_buf_release() could free the whole allocation with a single kfree(hw_buf).
That commit moved the scan mask to a separate bitmap_zalloc() allocation stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged.
Free the scan mask in iio_hw_buf_release() before freeing the buffer wrapper.
Which versions are affected by CVE-2026-64498?
How do I fix CVE-2026-64498?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64498 being exploited?
There is no known exploitation of CVE-2026-64498 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-64498, GHSA-vmjp-jvmv-9wwr, ROOT-OS-UBUNTU-2204-CVE-2026-64498, UBUNTU-CVE-2026-64498.