CVE-2026-93054uio: Fix stale info pointer in failed registration path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info. That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev->info and dereference freed memory. Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uio_unregister_device().
- CVSS
- 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a93e7b331568227500186a465fee3c2cb5dffd1f before 63eaa7663335d482a8825c231213e312cacea567; from a93e7b331568227500186a465fee3c2cb5dffd1f before df4faf65194ec6c315a59be4c6749eaeb3009243; from a93e7b331568227500186a465fee3c2cb5dffd1f before 506b43dde5f9ac0068b1360e6b5dbee07fda59fb; from a93e7b331568227500186a465fee3c2cb5dffd1f before 15340b00e665af805523b08515294a1aa1778151; from a93e7b331568227500186a465fee3c2cb5dffd1f before 234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac; from a93e7b331568227500186a465fee3c2cb5dffd1f before 16695e9059d80ea6661e8399064b0c01f641dd8c; from a93e7b331568227500186a465fee3c2cb5dffd1f before ec5bd6731183eb6f619140c9bef2ee11ed818c20; from a93e7b331568227500186a465fee3c2cb5dffd1f before 67b6fc084b034a91c3ec7907a3fed89a2450f30b; and 2 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/63eaa7663335d482a8825c231213e312cacea567
- https://git.kernel.org/stable/c/df4faf65194ec6c315a59be4c6749eaeb3009243
- https://git.kernel.org/stable/c/506b43dde5f9ac0068b1360e6b5dbee07fda59fb
- https://git.kernel.org/stable/c/15340b00e665af805523b08515294a1aa1778151
- https://git.kernel.org/stable/c/234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac
- https://git.kernel.org/stable/c/16695e9059d80ea6661e8399064b0c01f641dd8c
- https://git.kernel.org/stable/c/ec5bd6731183eb6f619140c9bef2ee11ed818c20
- https://git.kernel.org/stable/c/67b6fc084b034a91c3ec7907a3fed89a2450f30b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.