7.8
HIGH CVSS 3.1
CVE-2026-63930
iio: buffer: hw-consumer: fix use-after-free in error path
Description

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer. Fix this by using list_for_each_entry_safe().

INFO

Published Date :

July 19, 2026, 4:17 p.m.

Last Modified :

July 27, 2026, 5:44 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-63930 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Fix use-after-free by using list_for_each_entry_safe() for buffer iteration.
  • Update the Linux kernel to the corrected version.
  • Apply the patch that uses list_for_each_entry_safe().
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-63930 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-63930 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-63930 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-63930 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 20, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 19, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '48b66f8f936f369bb1a43c12aedbfeb2975baf4c', 'lessThan': 'b71893c57730809c222766e5718bb33610f11963', 'versionType': 'git'}, {'status': 'affected', 'version': '48b66f8f936f369bb1a43c12aedbfeb2975baf4c', 'lessThan': '2ff615fc455acda5425c4900160cbe11cfea4449', 'versionType': 'git'}, {'status': 'affected', 'version': '48b66f8f936f369bb1a43c12aedbfeb2975baf4c', 'lessThan': 'd2759d49860b9a39b5cde2fb88e4b822ddf5f58f', 'versionType': 'git'}, {'status': 'affected', 'version': '48b66f8f936f369bb1a43c12aedbfeb2975baf4c', 'lessThan': '29783e6b6ec0b7152a15e53a063f17537e81177d', 'versionType': 'git'}, {'status': 'affected', 'version': '48b66f8f936f369bb1a43c12aedbfeb2975baf4c', 'lessThan': 'e965627f0d442bfcae3f496c90cb653fb0917a61', 'versionType': 'git'}, {'status': 'affected', 'version': '48b66f8f936f369bb1a43c12aedbfeb2975baf4c', 'lessThan': 'a3763ae33476328cf8d661742deb9daec78eac96', 'versionType': 'git'}, {'status': 'affected', 'version': '48b66f8f936f369bb1a43c12aedbfeb2975baf4c', 'lessThan': '9319c94f63ed10723afd738d79f5617daba87cc8', 'versionType': 'git'}, {'status': 'affected', 'version': '48b66f8f936f369bb1a43c12aedbfeb2975baf4c', 'lessThan': '6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4', 'versionType': 'git'}], 'programFiles': ['drivers/iio/buffer/industrialio-hw-consumer.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/iio/buffer/industrialio-hw-consumer.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer. Fix this by using list_for_each_entry_safe().
    Added Reference https://git.kernel.org/stable/c/29783e6b6ec0b7152a15e53a063f17537e81177d
    Added Reference https://git.kernel.org/stable/c/2ff615fc455acda5425c4900160cbe11cfea4449
    Added Reference https://git.kernel.org/stable/c/6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4
    Added Reference https://git.kernel.org/stable/c/9319c94f63ed10723afd738d79f5617daba87cc8
    Added Reference https://git.kernel.org/stable/c/a3763ae33476328cf8d661742deb9daec78eac96
    Added Reference https://git.kernel.org/stable/c/b71893c57730809c222766e5718bb33610f11963
    Added Reference https://git.kernel.org/stable/c/d2759d49860b9a39b5cde2fb88e4b822ddf5f58f
    Added Reference https://git.kernel.org/stable/c/e965627f0d442bfcae3f496c90cb653fb0917a61
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.