The vulnerability (CVE-2026-64498) in the Linux kernel's IIO subsystem involves improper memory management of the scan_mask bitmap in the hw-consumer buffer. A prior commit separated scan_mask into its own allocation, but the buffer release function (iio_hw_buf_release) did not free this allocation, causing a potential use-after-free or memory leak. The fix involves explicitly freeing the scan_mask bitmap before freeing the buffer wrapper, ensuring proper cleanup.

Improper freeing of the scan_mask bitmap could lead to kernel memory corruption or leaks, potentially destabilizing the system or causing denial of service. No known exploits are reported in the wild. The vulnerability affects kernel stability and security but does not have a reported CVSS score or documented exploitation impact.

A fix has been implemented in the Linux kernel source code to free the scan_mask bitmap on buffer release. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or repositories for the patch and apply it accordingly.