CVE-2026-89742: rapidio: mport_cdev: fix use-after-free in dma_req_free()
In the Linux kernel, the following vulnerability has been resolved:
rapidio: mportcdev: fix use-after-free in dmareqfree()
dmareqfree() acquires bufmutex through req->map, drops the mapping reference with krefput(), and then dereferences req->map again to unlock the mutex.
If krefput() drops the last reference, mportreleasemapping() frees the mapping, and the subsequent mutexunlock() dereferences a freed object. This is a use-after-free.
Fix this by caching map and md before krefput(), clearing req->map while holding bufmutex, and using the cached md for mutex unlocking.
The bug is reachable from userspace via the RapidIO mport character device interface.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the RapidIO mport cdev code path so that in dma_req_free(): cache map and md before calling kref_put(), clear req->map while holding buf_mutex, and use the cached md to unlock the mutex after kref_put(). This prevents mutex_unlock() from dereferencing a freed object (use-after-free).
Linux kernel (RapidIO mport character device / mport_cdev) dma_req_free() locking/unlocking logic = Cache map and md before kref_put(); clear req->map while holding buf_mutex; use cached md for mutex unlocking interface
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running a Linux kernel with the RapidIO mport character device interface available to userspace are exposed. The vulnerability is reachable from userspace through that interface.
What does an attacker need to exploit it?
An attacker needs userspace access to the RapidIO mport character device interface. The provided information does not specify any additional privileges, configuration requirements, or exploitation prerequisites.
What should be prioritized for remediation?
Apply a kernel update containing the fix, which prevents dereferencing the mapping after its reference count may have reached zero. The provided references identify stable-kernel commits carrying the correction.