---
cve: "CVE-2026-64498"
severity: "LOW"
cvss: 3.1
epss: "16%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-07-25 10:17:35"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-15T09:26:38+02:00"
---

# CVE-2026-64498

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: hw-consumer: free scan_mask on buffer release

The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer:
hw-consumer: remove redundant scan_mask flexible array").

Before that change, the scan mask storage was embedded in struct
hw_consumer_buffer, so iio_hw_buf_release() could free the whole
allocation with a single kfree(hw_buf).

That commit moved the scan mask to a separate bitmap_zalloc() allocation
stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged.

Free the scan mask in iio_hw_buf_release() before freeing the buffer
wrapper.

## Patch verfügbar (OSV)

- Kernel ≥ 7.1.4

## Referenzen

- <https://git.kernel.org/stable/c/fb8e18f8ca724bd4de4643cad5b7c7230b9a5a71>
- <https://git.kernel.org/stable/c/6325d6e2204327965b849c0a16efb6ac9202e5a8>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-64498) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_