CVE-2026-89742

rapidio: mport_cdev: fix use-after-free in dma_req_free()

State: Published
Severity: 7.8 High
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

rapidio: mport_cdev: fix use-after-free in dma_req_free()

dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex.

If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free.

Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking.

The bug is reachable from userspace via the RapidIO mport character device interface.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e8de370188d098bb49483c287b44925957c3c9b6 to before 00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6aAffected e8de370188d098bb49483c287b44925957c3c9b6 to before fc79c07cdcde02c5b17633d78777de6ac2c14b29Affected e8de370188d098bb49483c287b44925957c3c9b6 to before 26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6Affected e8de370188d098bb49483c287b44925957c3c9b6 to before bd8881c24a9520f9c3d3e855d866197f63e471a7Affected e8de370188d098bb49483c287b44925957c3c9b6 to before 9a9929ec875ff20922c90c96fd544ae8a2a61a8dAffected e8de370188d098bb49483c287b44925957c3c9b6 to before e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0Affected e8de370188d098bb49483c287b44925957c3c9b6 to before 211c68d817a3d9dc14c0026a59da7cac30f8147eAffected e8de370188d098bb49483c287b44925957c3c9b6 to before 5cbef379a94b161726c5f504598bf4791d45cedcAffected
LinuxLinux	4.6Affected before 4.6Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e8de370188d098bb49483c287b44925957c3c9b6 to before 00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6aAffected
e8de370188d098bb49483c287b44925957c3c9b6 to before fc79c07cdcde02c5b17633d78777de6ac2c14b29Affected
e8de370188d098bb49483c287b44925957c3c9b6 to before 26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6Affected
e8de370188d098bb49483c287b44925957c3c9b6 to before bd8881c24a9520f9c3d3e855d866197f63e471a7Affected
e8de370188d098bb49483c287b44925957c3c9b6 to before 9a9929ec875ff20922c90c96fd544ae8a2a61a8dAffected
e8de370188d098bb49483c287b44925957c3c9b6 to before e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0Affected
e8de370188d098bb49483c287b44925957c3c9b6 to before 211c68d817a3d9dc14c0026a59da7cac30f8147eAffected
e8de370188d098bb49483c287b44925957c3c9b6 to before 5cbef379a94b161726c5f504598bf4791d45cedcAffected

LinuxLinux

4.6Affected
before 4.6Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.