CVE-2026-63929

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: Fix DMA fence leak in iiobufferenqueue_dmabuf()

iiobufferenqueuedmabuf() allocates a struct iiodmafence (104 bytes, kmalloc-128) via kmallocobj()+dmafenceinit(), which sets the initial kref to 1. It then calls dmaresvadd_fence() which takes a second reference (kref=2), and stores a raw pointer in block->fence.

On the success path the function returns without calling dmafenceput() to release the initial reference, so every buffer enqueue permanently leaks one kmalloc-128 allocation.

The iiobuffercleanup() work item only releases the temporary reference taken during completion signalling by iiobuffersignaldmabufdone(); the initial reference from dmafenceinit() is never released.

With four iiorwdev instances at 240kHz and 512 samples per buffer, this produces ~1875 kmalloc-128 allocations per second matching the observed slab growth exactly. A test with ftrace confirmed that the dmafence_destroy event was never triggered.

Fix by calling dmafenceput() after dmaresvadd_fence(), transferring ownership of the fence to the DMA reservation object. The DMA fence then gets properly discarded after being signalled.