CVE-2026-90319

rapidio: clear mport->net when rio_add_net() fails

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

rapidio: clear mport->net when rio_add_net() fails

rio_alloc_net() stores the newly allocated rio_net in mport->net before rio_scan_alloc_net() registers the device.

If rio_add_net() fails, rio_scan_alloc_net() drops the device reference with put_device(), which releases the rio_net through the device release callback. However, mport->net is left pointing at the freed object.

A later mport unregister path can then dereference the dangling mport->net pointer and may try to free the same rio_net again.

Clear mport->net in the rio_add_net() failure path, matching the cleanup done for the destID table allocation failure path.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7 to before 24f60ebabeb8757cec8ec2f97660d521bc9147ecAffected 181d4daaefb3bceeb2f2635ba9f3781eeda9e550 to before 6a760a53e73064735cdfa9e51c664983a89baf96Affected ad82be4298a89a9ae46f07128bdf3d8614bce745 to before 3f00999e44d9984036a029dbad9d2afe94a674d0Affected e6411c3b9512dba09af7d014d474516828c89706 to before 332591a245de978349a7558f8b20469951bb77ccAffected c332f3e2df0fcae5a45fd55cc18902fb1e4825ca to before 75f0bc167b96bbbef8182b88308c732af82c8d83Affected e842f9a1edf306bf36fe2a4d847a0b0d458770de to before 44a37264b26911e13d0a4f5630751c4157ed0354Affected e842f9a1edf306bf36fe2a4d847a0b0d458770de to before 530a9d5ef831a0049dad9a6b2b92d02301352c38Affected e842f9a1edf306bf36fe2a4d847a0b0d458770de to before b74030fbf187b43c1f85b66a7082e9946511cb5dAffected 6d22953c4a183d0b7fdf34d68c5debd16da6edc5Affected a0d069ccc475abaaa79c6368ee27fc0b5912bea8Affected 5.10.235 to before 5.10.270Affected 5.15.179 to before 5.15.221Affected 6.1.131 to before 6.1.188Affected 6.6.83 to before 6.6.157Affected 6.12.19 to before 6.12.110Affected 5.4.291 to before 5.5Affected 6.13.7 to before 6.14Affected
LinuxLinux	6.14Affected before 6.14Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7 to before 24f60ebabeb8757cec8ec2f97660d521bc9147ecAffected
181d4daaefb3bceeb2f2635ba9f3781eeda9e550 to before 6a760a53e73064735cdfa9e51c664983a89baf96Affected
ad82be4298a89a9ae46f07128bdf3d8614bce745 to before 3f00999e44d9984036a029dbad9d2afe94a674d0Affected
e6411c3b9512dba09af7d014d474516828c89706 to before 332591a245de978349a7558f8b20469951bb77ccAffected
c332f3e2df0fcae5a45fd55cc18902fb1e4825ca to before 75f0bc167b96bbbef8182b88308c732af82c8d83Affected
e842f9a1edf306bf36fe2a4d847a0b0d458770de to before 44a37264b26911e13d0a4f5630751c4157ed0354Affected
e842f9a1edf306bf36fe2a4d847a0b0d458770de to before 530a9d5ef831a0049dad9a6b2b92d02301352c38Affected
e842f9a1edf306bf36fe2a4d847a0b0d458770de to before b74030fbf187b43c1f85b66a7082e9946511cb5dAffected
6d22953c4a183d0b7fdf34d68c5debd16da6edc5Affected
a0d069ccc475abaaa79c6368ee27fc0b5912bea8Affected
5.10.235 to before 5.10.270Affected
5.15.179 to before 5.15.221Affected
6.1.131 to before 6.1.188Affected
6.6.83 to before 6.6.157Affected
6.12.19 to before 6.12.110Affected
5.4.291 to before 5.5Affected
6.13.7 to before 6.14Affected

LinuxLinux

6.14Affected
before 6.14Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.