CVE-2026-89742
Description
In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.
How to fix
- Linux Linux00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a, fc79c07cdcde02c5b17633d78777de6ac2c14b29, 26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6, bd8881c24a9520f9c3d3e855d866197f63e471a7, 9a9929ec875ff20922c90c96fd544ae8a2a61a8d, e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0, 211c68d817a3d9dc14c0026a59da7cac30f8147e, 5cbef379a94b161726c5f504598bf4791d45cedc or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | e8de370188d098bb49483c287b44925957c3c9b6 ≤ v < 00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a, e8de370188d098bb49483c287b44925957c3c9b6 ≤ v < fc79c07cdcde02c5b17633d78777de6ac2c14b29, e8de370188d098bb49483c287b44925957c3c9b6 ≤ v < 26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6, e8de370188d098bb49483c287b44925957c3c9b6 ≤ v < bd8881c24a9520f9c3d3e855d866197f63e471a7, e8de370188d098bb49483c287b44925957c3c9b6 ≤ v < 9a9929ec875ff20922c90c96fd544ae8a2a61a8d, e8de370188d098bb49483c287b44925957c3c9b6 ≤ v < e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0, e8de370188d098bb49483c287b44925957c3c9b6 ≤ v < 211c68d817a3d9dc14c0026a59da7cac30f8147e, e8de370188d098bb49483c287b44925957c3c9b6 ≤ v < 5cbef379a94b161726c5f504598bf4791d45cedc, 4.6 | 00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a, fc79c07cdcde02c5b17633d78777de6ac2c14b29, 26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6, bd8881c24a9520f9c3d3e855d866197f63e471a7, 9a9929ec875ff20922c90c96fd544ae8a2a61a8d, e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0, 211c68d817a3d9dc14c0026a59da7cac30f8147e, 5cbef379a94b161726c5f504598bf4791d45cedc |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.