CVE-2026-89742
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-11 20:20:04.863000
Last modified
2026-10-19 09:18:17.037000
View original CVE JSON
{
"id": "CVE-2026-89742",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-11T20:20:04.863",
"lastModified": "2026-10-19T09:18:17.037",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: mport_cdev: fix use-after-free in dma_req_free()\n\ndma_req_free() acquires buf_mutex through req->map, drops the mapping\nreference with kref_put(), and then dereferences req->map again to unlock\nthe mutex.\n\nIf kref_put() drops the last reference, mport_release_mapping() frees the\nmapping, and the subsequent mutex_unlock() dereferences a freed object. \nThis is a use-after-free.\n\nFix this by caching map and md before kref_put(), clearing req->map while\nholding buf_mutex, and using the cached md for mutex unlocking.\n\nThe bug is reachable from userspace via the RapidIO mport character device\ninterface."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/rapidio/devices/rio_mport_cdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "e8de370188d098bb49483c287b44925957c3c9b6",
"lessThan": "00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a",
"versionType": "git",
"status": "affected"
},
{
"version": "e8de370188d098bb49483c287b44925957c3c9b6",
"lessThan": "fc79c07cdcde02c5b17633d78777de6ac2c14b29",
"versionType": "git",
"status": "affected"
},
{
"version": "e8de370188d098bb49483c287b44925957c3c9b6",
"lessThan": "26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6",
"versionType": "git",
"status": "affected"
},
{
"version": "e8de370188d098bb49483c287b44925957c3c9b6",
"lessThan": "bd8881c24a9520f9c3d3e855d866197f63e471a7",
"versionType": "git",
"status": "affected"
},
{
"version": "e8de370188d098bb49483c287b44925957c3c9b6",
"lessThan": "9a9929ec875ff20922c90c96fd544ae8a2a61a8d",
"versionType": "git",
"status": "affected"
},
{
"version": "e8de370188d098bb49483c287b44925957c3c9b6",
"lessThan": "e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0",
"versionType": "git",
"status": "affected"
},
{
"version": "e8de370188d098bb49483c287b44925957c3c9b6",
"lessThan": "211c68d817a3d9dc14c0026a59da7cac30f8147e",
"versionType": "git",
"status": "affected"
},
{
"version": "e8de370188d098bb49483c287b44925957c3c9b6",
"lessThan": "5cbef379a94b161726c5f504598bf4791d45cedc",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/rapidio/devices/rio_mport_cdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.6",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.6",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.270",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.221",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.188",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.157",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.109",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.50",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.4",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/211c68d817a3d9dc14c0026a59da7cac30f8147e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5cbef379a94b161726c5f504598bf4791d45cedc",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9a9929ec875ff20922c90c96fd544ae8a2a61a8d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bd8881c24a9520f9c3d3e855d866197f63e471a7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fc79c07cdcde02c5b17633d78777de6ac2c14b29",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}