CVE-2026-89742rapidio: mport_cdev: fix use-after-free in dma_req_free()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e8de370188d098bb49483c287b44925957c3c9b6 before 00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a; from e8de370188d098bb49483c287b44925957c3c9b6 before fc79c07cdcde02c5b17633d78777de6ac2c14b29; from e8de370188d098bb49483c287b44925957c3c9b6 before 26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6; from e8de370188d098bb49483c287b44925957c3c9b6 before bd8881c24a9520f9c3d3e855d866197f63e471a7; from e8de370188d098bb49483c287b44925957c3c9b6 before 9a9929ec875ff20922c90c96fd544ae8a2a61a8d; from e8de370188d098bb49483c287b44925957c3c9b6 before e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0; from e8de370188d098bb49483c287b44925957c3c9b6 before 211c68d817a3d9dc14c0026a59da7cac30f8147e; from e8de370188d098bb49483c287b44925957c3c9b6 before 5cbef379a94b161726c5f504598bf4791d45cedc | CNA record |
References
- https://git.kernel.org/stable/c/00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a
- https://git.kernel.org/stable/c/fc79c07cdcde02c5b17633d78777de6ac2c14b29
- https://git.kernel.org/stable/c/26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6
- https://git.kernel.org/stable/c/bd8881c24a9520f9c3d3e855d866197f63e471a7
- https://git.kernel.org/stable/c/9a9929ec875ff20922c90c96fd544ae8a2a61a8d
- https://git.kernel.org/stable/c/e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0
- https://git.kernel.org/stable/c/211c68d817a3d9dc14c0026a59da7cac30f8147e
- https://git.kernel.org/stable/c/5cbef379a94b161726c5f504598bf4791d45cedc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.