CVE-2026-64496: Linux Kernel Race Condition Vulnerability

CVE-2026-64496 Overview

CVE-2026-64496 is a race condition vulnerability in the Linux kernel's Industrial I/O (IIO) subsystem. The flaw resides in iio_event_getfd(), where the event First-In-First-Out (FIFO) buffer is reset after the file descriptor has been installed in the process descriptor table. A concurrent thread can guess the newly allocated file descriptor and issue a read() before the calling thread returns to userspace. This causes kfifo_to_user() and kfifo_reset_out() to run in parallel, corrupting the FIFO indexes. The result is an out-of-bounds read that can leak adjacent kernel memory to userspace.

Critical Impact
A local, authenticated attacker with access to an IIO character device can trigger a race condition that leaks adjacent kernel memory and may crash the system.

Affected Products

Linux kernel (IIO subsystem)
Distributions shipping vulnerable kernel versions prior to the referenced stable commits
Systems exposing IIO character devices to non-root users

Discovery Timeline

2026-07-25 - CVE-2026-64496 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64496

Vulnerability Analysis

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race in the IIO event character device implementation. iio_event_getfd() calls anon_inode_getfd(), which allocates a file descriptor, creates the anonymous inode, and installs the descriptor in the calling process's file descriptor table before returning. The IIO code then resets the event FIFO using kfifo_reset_out(), before IIO_GET_EVENT_FD_IOCTL copies the file descriptor number back to userspace.

Because file descriptor tables are shared across threads in a process, a sibling thread can enumerate newly allocated descriptors and issue read() calls against the IIO event file immediately after installation. The read() handler executes kfifo_to_user() in iio_event_chrdev_read(), which runs concurrently with the reset in the original thread.

Root Cause

The kfifo documentation states that kfifo_reset_out() is only safe when invoked from the sole reader thread with no concurrent readers. In this scenario, a second reader can enter kfifo_to_user() before the reset completes. The reader captures stale out and in indexes, and after the reset advances out to the current in, the concurrent reader then advances out further using the pre-reset delta. The out index moves past in, creating an underflowed apparent length on the next read.

Attack Vector

A local attacker with permission to open an IIO character device (typically under /dev/iio:deviceN) can create two threads sharing the file descriptor table. Thread A calls the IIO_GET_EVENT_FD_IOCTL ioctl repeatedly. Thread B brute-forces the newly installed descriptor and issues read() calls in parallel. When the race succeeds, subsequent reads copy data past the FIFO's valid contents, disclosing adjacent kernel memory to userspace.

No verified public proof-of-concept is available. See the upstream fix commits referenced below for the corrected ordering.

Detection Methods for CVE-2026-64496

Indicators of Compromise

Unexpected multi-threaded processes repeatedly invoking IIO_GET_EVENT_FD_IOCTL against /dev/iio:* devices
Kernel warnings or KASAN reports referencing kfifo_to_user or iio_event_chrdev_read
Unprivileged processes reading anomalous volumes of data from IIO event file descriptors

Detection Strategies

Audit openat and ioctl syscall telemetry targeting /dev/iio:device* paths from non-root users using auditd or eBPF sensors
Correlate rapid successive IIO_GET_EVENT_FD_IOCTL calls followed by read() from a sibling thread as suspicious behavior
Ingest kernel ring buffer messages and alert on KASAN, slab-out-of-bounds, or oops signatures involving IIO functions

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform and retain them for post-incident analysis
Baseline which processes legitimately access IIO devices and alert on deviations
Track kernel module and version inventory across the fleet to identify hosts running vulnerable builds

How to Mitigate CVE-2026-64496

Immediate Actions Required

Inventory Linux hosts exposing IIO character devices and identify kernel versions predating the referenced stable commits
Apply distribution kernel updates that incorporate the upstream fix as soon as they are available
Restrict access to /dev/iio:* devices to trusted users and processes through Unix permissions or udev rules

Patch Information

The upstream fix moves the kfifo_reset_out() call to before anon_inode_getfd(). At that point the event file descriptor is marked busy but not yet installed in the process descriptor table, so userspace cannot access it while the FIFO is reset. Applicable stable kernel commits include Linux Kernel Commit 0d4a646, Linux Kernel Commit 72c6aa8, Linux Kernel Commit 9dc84ba, Linux Kernel Commit 9edefd4, Linux Kernel Commit a13ef1a, Linux Kernel Commit af791d2, Linux Kernel Commit d16a702, and Linux Kernel Commit f187dc5.

Workarounds

Set restrictive permissions on IIO character devices via udev so only privileged users or dedicated service accounts can open them
Unload IIO drivers on systems that do not require sensor telemetry using modprobe -r or a modules blacklist
Enforce mandatory access control policies (SELinux, AppArmor) that deny non-essential processes access to /dev/iio:*

bash

# Restrict IIO device access via udev rule
cat >/etc/udev/rules.d/90-iio-restrict.rules <<'EOF'
KERNEL=="iio:device*", MODE="0600", OWNER="root", GROUP="root"
EOF
udevadm control --reload-rules && udevadm trigger