CVE-2026-89742: rapidio: mport_cdev: fix use-after-free in dma_req_free()

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

rapidio: mportcdev: fix use-after-free in dmareqfree()

dmareqfree() acquires bufmutex through req->map, drops the mapping reference with krefput(), and then dereferences req->map again to unlock the mutex.

If krefput() drops the last reference, mportreleasemapping() frees the mapping, and the subsequent mutexunlock() dereferences a freed object. This is a use-after-free.

Fix this by caching map and md before krefput(), clearing req->map while holding bufmutex, and using the cached md for mutex unlocking.

The bug is reachable from userspace via the RapidIO mport character device interface.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Update the RapidIO mport cdev code path so that in dma_req_free(): cache map and md before calling kref_put(), clear req->map while holding buf_mutex, and use the cached md to unlock the mutex after kref_put(). This prevents mutex_unlock() from dereferencing a freed object (use-after-free).

    Linux kernel (RapidIO mport character device / mport_cdev) dma_req_free() locking/unlocking logic = Cache map and md before kref_put(); clear req->map while holding buf_mutex; use cached md for mutex unlocking interface

Event History

Sep 11, 2026
CVE Published
via MITRE·07:46 PM
Data Sourced
via MITRE·07:46 PM
Description

Frequently Asked Questions

1

Who is exposed to this issue?

Systems running a Linux kernel with the RapidIO mport character device interface available to userspace are exposed. The vulnerability is reachable from userspace through that interface.

2

What does an attacker need to exploit it?

An attacker needs userspace access to the RapidIO mport character device interface. The provided information does not specify any additional privileges, configuration requirements, or exploitation prerequisites.

3

What should be prioritized for remediation?

Apply a kernel update containing the fix, which prevents dereferencing the mapping after its reference count may have reached zero. The provided references identify stable-kernel commits carrying the correction.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203