CVE-2026-64498

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: buffer: hw-consumer: free scan_mask on buffer release<br /> <br /> The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer:<br /> hw-consumer: remove redundant scan_mask flexible array").<br /> <br /> Before that change, the scan mask storage was embedded in struct<br /> hw_consumer_buffer, so iio_hw_buf_release() could free the whole<br /> allocation with a single kfree(hw_buf).<br /> <br /> That commit moved the scan mask to a separate bitmap_zalloc() allocation<br /> stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged.<br /> <br /> Free the scan mask in iio_hw_buf_release() before freeing the buffer<br /> wrapper.