CVE-2026-89764

Received Received - Intake

Race Condition in Linux Kernel Devres Subsystem

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU. The revoker that does not claim the is_available swap returns immediately, but the revoker that did may still be executing drop_in_place() on the inner data. This can cause a use-after-free when the other revoker's caller proceeds to drop adjacent resources that drop_in_place() still references (e.g., Devres<DmaMappedSgt> racing with SGTable freeing the backing sg_table and pages). Fix this by adding a Completion. The release callback signals the Completion after revoke() finishes, and Devres::drop() waits for it when it loses the is_available swap. This ensures the wrapped object is fully torn down before Devres::drop() returns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-89764

EUVD

EUVD-2026-76676

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a race condition in the Linux kernel's Rust devres subsystem. It occurs when two paths try to revoke a Devres resource at the same time. One path calls Revocable::revoke() while the other calls revoke_nosync() on another CPU. This can lead to a use-after-free when one revoker drops adjacent resources that are still referenced by the other revoker's drop_in_place() operation.

Detection Guidance

This vulnerability is specific to the Linux kernel's Rust devres subsystem and requires kernel-level inspection. Detection involves checking kernel logs for race conditions or use-after-free errors in devres operations. Use commands like dmesg | grep -i 'devres' or journalctl -k | grep -i 'race' to identify suspicious activity.

Impact Analysis

This vulnerability could cause system instability or crashes due to memory corruption. It may lead to arbitrary code execution or privilege escalation if exploited. Systems using affected Linux kernel versions with Rust devres functionality could experience data corruption or denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a race condition in the Linux kernel's device resource management that could lead to use-after-free errors, potentially causing system instability or crashes. Compliance impacts would only occur if such failures disrupted data processing or security controls, which is not specified in the provided context.

Mitigation Strategies

Apply the latest kernel patch or update to a version that includes the fix for this race condition. Monitor kernel logs for devres-related errors post-update. If immediate patching is not possible, restrict access to kernel modules that use devres to reduce exposure.

Hi! I’m here to help you understand CVE-2026-89764. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70