7.8

CVE-2026-89742

rapidio: mport_cdev: fix use-after-free in dma_req_free()

In the Linux kernel, the following vulnerability has been resolved:

rapidio: mport_cdev: fix use-after-free in dma_req_free()

dma_req_free() acquires buf_mutex through req->map, drops the mapping
reference with kref_put(), and then dereferences req->map again to unlock
the mutex.

If kref_put() drops the last reference, mport_release_mapping() frees the
mapping, and the subsequent mutex_unlock() dereferences a freed object. 
This is a use-after-free.

Fix this by caching map and md before kref_put(), clearing req->map while
holding buf_mutex, and using the cached md for mutex unlocking.

The bug is reachable from userspace via the RapidIO mport character device
interface.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version e8de370188d098bb49483c287b44925957c3c9b6
Version < 00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a
Status affected
Version e8de370188d098bb49483c287b44925957c3c9b6
Version < fc79c07cdcde02c5b17633d78777de6ac2c14b29
Status affected
Version e8de370188d098bb49483c287b44925957c3c9b6
Version < 26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6
Status affected
Version e8de370188d098bb49483c287b44925957c3c9b6
Version < bd8881c24a9520f9c3d3e855d866197f63e471a7
Status affected
Version e8de370188d098bb49483c287b44925957c3c9b6
Version < 9a9929ec875ff20922c90c96fd544ae8a2a61a8d
Status affected
Version e8de370188d098bb49483c287b44925957c3c9b6
Version < e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0
Status affected
Version e8de370188d098bb49483c287b44925957c3c9b6
Version < 211c68d817a3d9dc14c0026a59da7cac30f8147e
Status affected
Version e8de370188d098bb49483c287b44925957c3c9b6
Version < 5cbef379a94b161726c5f504598bf4791d45cedc
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 4.6
Status affected
Version 0
Version < 4.6
Status unaffected
Version <= 5.10.*
Version 5.10.270
Status unaffected
Version <= 5.15.*
Version 5.15.221
Status unaffected
Version <= 6.1.*
Version 6.1.188
Status unaffected
Version <= 6.6.*
Version 6.6.157
Status unaffected
Version <= 6.12.*
Version 6.12.109
Status unaffected
Version <= 6.18.*
Version 6.18.50
Status unaffected
Version <= 7.2.*
Version 7.2.4
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.054
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/9a9929ec875ff20922c90c96fd544ae8a2a61a8d
https://git.kernel.org/stable/c/e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0
https://git.kernel.org/stable/c/211c68d817a3d9dc14c0026a59da7cac30f8147e
https://git.kernel.org/stable/c/5cbef379a94b161726c5f504598bf4791d45cedc
https://git.kernel.org/stable/c/00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a
https://git.kernel.org/stable/c/26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6
https://git.kernel.org/stable/c/bd8881c24a9520f9c3d3e855d866197f63e471a7
https://git.kernel.org/stable/c/fc79c07cdcde02c5b17633d78777de6ac2c14b29