UBUNTU-CVE-2026-93054: High severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After deviceadd(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, uioregisterdevice() unwinds the device but leaves idev->info pointing at the caller-owned struct uioinfo. That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uiodevice, while the caller sees registration failure and may free its struct uioinfo. Later file operations can then follow idev->info and dereference freed memory. Handle post-deviceadd() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under infolock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uiounregisterdevice().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the failed __uio_register_device() path after device_add(), remove UIO attributes while idev->info is still valid; clear idev->info under info_lock; wake existing waiters and async users; then remove the device and minor so already-open file descriptors observe the device-gone state.