CVE-2026-90319rapidio: clear mport->net when rio_add_net() fails
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport->net when rio_add_net() fails rio_alloc_net() stores the newly allocated rio_net in mport->net before rio_scan_alloc_net() registers the device. If rio_add_net() fails, rio_scan_alloc_net() drops the device reference with put_device(), which releases the rio_net through the device release callback. However, mport->net is left pointing at the freed object. A later mport unregister path can then dereference the dangling mport->net pointer and may try to free the same rio_net again. Clear mport->net in the rio_add_net() failure path, matching the cleanup done for the destID table allocation failure path.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7 before 24f60ebabeb8757cec8ec2f97660d521bc9147ec; 181d4daaefb3bceeb2f2635ba9f3781eeda9e550 builds before 6a760a53e73064735cdfa9e51c664983a89baf96; from ad82be4298a89a9ae46f07128bdf3d8614bce745 before 3f00999e44d9984036a029dbad9d2afe94a674d0; from e6411c3b9512dba09af7d014d474516828c89706 before 332591a245de978349a7558f8b20469951bb77cc; from c332f3e2df0fcae5a45fd55cc18902fb1e4825ca before 75f0bc167b96bbbef8182b88308c732af82c8d83; from e842f9a1edf306bf36fe2a4d847a0b0d458770de before 44a37264b26911e13d0a4f5630751c4157ed0354; from e842f9a1edf306bf36fe2a4d847a0b0d458770de before 530a9d5ef831a0049dad9a6b2b92d02301352c38; from e842f9a1edf306bf36fe2a4d847a0b0d458770de before b74030fbf187b43c1f85b66a7082e9946511cb5d; and 9 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/24f60ebabeb8757cec8ec2f97660d521bc9147ec
- https://git.kernel.org/stable/c/6a760a53e73064735cdfa9e51c664983a89baf96
- https://git.kernel.org/stable/c/3f00999e44d9984036a029dbad9d2afe94a674d0
- https://git.kernel.org/stable/c/332591a245de978349a7558f8b20469951bb77cc
- https://git.kernel.org/stable/c/75f0bc167b96bbbef8182b88308c732af82c8d83
- https://git.kernel.org/stable/c/44a37264b26911e13d0a4f5630751c4157ed0354
- https://git.kernel.org/stable/c/530a9d5ef831a0049dad9a6b2b92d02301352c38
- https://git.kernel.org/stable/c/b74030fbf187b43c1f85b66a7082e9946511cb5d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.