https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 16:33:53 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90319 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rapidio: clear mport-&gt;net when rio_add_net() fails</p> <p>rio_alloc_net() stores the newly allocated rio_net in mport-&gt;net before rio_scan_alloc_net() registers the device.</p> <p>If rio_add_net() fails, rio_scan_alloc_net() drops the device reference with put_device(), which releases the rio_net through the device release callback. However, mport-&gt;net is left pointing at the freed object.</p> <p>A later mport unregister path can then dereference the dangling mport-&gt;net pointer and may try to free the same rio_net again.</p> <p>Clear mport-&gt;net in the rio_add_net() failure path, matching the cleanup done for the destID table allocation failure path.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rapidio: clear mport-&gt;net when rio_add_net() fails</p> <p>rio_alloc_net() stores the newly allocated rio_net in mport-&gt;net before rio_scan_alloc_net() registers the device.</p> <p>If rio_add_net() fails, rio_scan_alloc_net() drops the device reference with put_device(), which releases the rio_net through the device release callback. However, mport-&gt;net is left pointing at the freed object.</p> <p>A later mport unregister path can then dereference the dangling mport-&gt;net pointer and may try to free the same rio_net again.</p> <p>Clear mport-&gt;net in the rio_add_net() failure path, matching the cleanup done for the destID table allocation failure path.</p> https://vulnerability.circl.lu/vuln/cve-2026-90319