In the Linux kernel, the following vulnerability has been resolved: iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF The atlas driver requests its hardware data-ready IRQ with devm_request_threaded_irq(); its threaded handler queues an irq_work, atlas_work_handler(), that calls iio_trigger_poll(data->trig). The IRQ is devm-managed, so free_irq() runs from the devres unwind after atlas_remove() returns without flushing that irq_work. Once a buffer is enabled, conversion-complete IRQs keep firing and queueing it; a pending irq_work can therefore run after the unwind has freed atlas_data/indio_dev and the trigger, when atlas_work_handler() derives the atlas_data pointer via container_of() and dereferences data->trig, a use-after-free. Call iio_trigger_poll_nested() directly from the threaded handler instead of bouncing through irq_work. free_irq() then drains the threaded handler, closing the window; other iio drivers with a threaded data-ready IRQ do the same (e.g. bmi270). This issue was found by an in-house static analysis tool.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146689 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF

    The atlas driver requests its hardware data-ready IRQ with     devm_request_threaded_irq(); its threaded handler queues an irq_work,     atlas_work_handler(), that calls iio_trigger_poll(data->trig).

    The IRQ is devm-managed, so free_irq() runs from the devres unwind after     atlas_remove() returns without flushing that irq_work.  Once a buffer is     enabled, conversion-complete IRQs keep firing and queueing it; a pending     irq_work can therefore run after the unwind has freed atlas_data/indio_dev     and the trigger, when atlas_work_handler() derives the atlas_data pointer     via container_of() and dereferences data->trig, a use-after-free.

    Call iio_trigger_poll_nested() directly from the threaded handler instead     of bouncing through irq_work.  free_irq() then drains the threaded handler,     closing the window; other iio drivers with a threaded data-ready IRQ do the     same (e.g. bmi270).

    This issue was found by an in-house static analysis tool.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF The atlas driver requests its     hardware data-ready IRQ with devm_request_threaded_irq(); its threaded handler queues an irq_work,     atlas_work_handler(), that calls iio_trigger_poll(data->trig). The IRQ is devm-managed, so free_irq() runs     from the devres unwind after atlas_remove() returns without flushing that irq_work. Once a buffer is     enabled, conversion-complete IRQs keep firing and queueing it; a pending irq_work can therefore run after     the unwind has freed atlas_data/indio_dev and the trigger, when atlas_work_handler() derives the     atlas_data pointer via container_of() and dereferences data->trig, a use-after-free. Call     iio_trigger_poll_nested() directly from the threaded handler instead of bouncing through irq_work.
    free_irq() then drains the threaded handler, closing the window; other iio drivers with a threaded data-     ready IRQ do the same (e.g. bmi270). This issue was found by an in-house static analysis tool.
    (CVE-2026-89938)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
373107	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146689)	Nessus	Unity Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
346511	Linux Distros Unpatched Vulnerability : CVE-2026-89938	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-89938

high

Tenable Plugins

high

high

high

high