CVE-2026-89742

Received Received - Intake

Use-After-Free in Linux Kernel RapidIO mport_cdev

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89742

EUVD

EUVD-2026-76654

Affected Vendors & Products

Vendor	Product	Version / Range
rapidio	mport_cdev	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's RapidIO subsystem. The issue occurs in the dma_req_free() function where a mutex is unlocked after the memory it protects has been freed. Specifically, the function drops a reference to a mapping with kref_put(), which may free the mapping, then tries to unlock a mutex using a pointer to the now-freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's RapidIO mport character device interface. Detection requires checking kernel logs for use-after-free errors related to dma_req_free() or RapidIO operations. Use commands like 'dmesg | grep -i rapidio' or 'journalctl -k | grep -i rapidio' to search for related errors.

Impact Analysis

This vulnerability could allow an attacker with access to the RapidIO mport character device interface to potentially execute arbitrary code or cause a system crash. It may lead to privilege escalation or denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's RapidIO mport character device interface. It does not directly relate to data privacy, security controls, or compliance requirements under standards like GDPR or HIPAA. The impact is limited to kernel memory corruption and potential system instability.

Mitigation Strategies

Apply the kernel patch that fixes this use-after-free issue in the RapidIO mport_cdev driver. Update your Linux kernel to a version containing the fix. If immediate patching is not possible, consider disabling the RapidIO mport_cdev module via 'modprobe -r mport_cdev' if not required.

Hi! I’m here to help you understand CVE-2026-89742. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70