A race condition in the Linux kernel IIO subsystem, exploitable by local users, poses a high risk of information disclosure and potential denial of service.

This is a race condition (CWE-362) occurring within the IIO event handling mechanism. A local attacker with low privileges can trigger a conflict between the file descriptor allocation and the FIFO reset process, allowing unauthorized access to kernel data structures.

Successful exploitation allows a local attacker to read data from the kernel FIFO buffer, which may contain sensitive information. Given the CVSS score of 7.1, this vulnerability presents a significant risk to systems where low privileged users are present, as it enables the compromise of confidentiality and system integrity. This could lead to unauthorized data exposure or system crashes, impacting operational availability.

Immediate Action: Update the Linux kernel to the corrected versions (5.10.261, 5.15.212, 6.1.178, 6.6.145, or later) as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unusual kernel-related errors or repeated attempts to access IIO event interfaces by unauthorized processes.

Compensating Controls: Restrict access to IIO character devices to only necessary users and processes to reduce the local attack surface.

Public Exploit Available: Unknown.

This vulnerability represents a significant local security flaw within the Linux kernel. Administrators should prioritize patching their kernel versions to the specified fixed releases to eliminate the race condition. Regular kernel updates are essential to mitigating this and similar local privilege or information disclosure risks.