https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 06:35:21 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89742 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rapidio: mport_cdev: fix use-after-free in dma_req_free()</p> <p>dma_req_free() acquires buf_mutex through req-&gt;map, drops the mapping reference with kref_put(), and then dereferences req-&gt;map again to unlock the mutex.</p> <p>If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free.</p> <p>Fix this by caching map and md before kref_put(), clearing req-&gt;map while holding buf_mutex, and using the cached md for mutex unlocking.</p> <p>The bug is reachable from userspace via the RapidIO mport character device interface.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rapidio: mport_cdev: fix use-after-free in dma_req_free()</p> <p>dma_req_free() acquires buf_mutex through req-&gt;map, drops the mapping reference with kref_put(), and then dereferences req-&gt;map again to unlock the mutex.</p> <p>If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free.</p> <p>Fix this by caching map and md before kref_put(), clearing req-&gt;map while holding buf_mutex, and using the cached md for mutex unlocking.</p> <p>The bug is reachable from userspace via the RapidIO mport character device interface.</p> https://vulnerability.circl.lu/vuln/cve-2026-89742