GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89742 (GCVE-0-2026-89742)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-14 12:02
VLAI
Title
rapidio: mport_cdev: fix use-after-free in dma_req_free()
Summary
In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e8de370188d098bb49483c287b44925957c3c9b6 , < 00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a (git)
Affected: e8de370188d098bb49483c287b44925957c3c9b6 , < fc79c07cdcde02c5b17633d78777de6ac2c14b29 (git)
Affected: e8de370188d098bb49483c287b44925957c3c9b6 , < 26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6 (git)
Affected: e8de370188d098bb49483c287b44925957c3c9b6 , < bd8881c24a9520f9c3d3e855d866197f63e471a7 (git)
Affected: e8de370188d098bb49483c287b44925957c3c9b6 , < 9a9929ec875ff20922c90c96fd544ae8a2a61a8d (git)
Affected: e8de370188d098bb49483c287b44925957c3c9b6 , < e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0 (git)
Affected: e8de370188d098bb49483c287b44925957c3c9b6 , < 211c68d817a3d9dc14c0026a59da7cac30f8147e (git)
Affected: e8de370188d098bb49483c287b44925957c3c9b6 , < 5cbef379a94b161726c5f504598bf4791d45cedc (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/rapidio/devices/rio_mport_cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a",
              "status": "affected",
              "version": "e8de370188d098bb49483c287b44925957c3c9b6",
              "versionType": "git"
            },
            {
              "lessThan": "fc79c07cdcde02c5b17633d78777de6ac2c14b29",
              "status": "affected",
              "version": "e8de370188d098bb49483c287b44925957c3c9b6",
              "versionType": "git"
            },
            {
              "lessThan": "26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6",
              "status": "affected",
              "version": "e8de370188d098bb49483c287b44925957c3c9b6",
              "versionType": "git"
            },
            {
              "lessThan": "bd8881c24a9520f9c3d3e855d866197f63e471a7",
              "status": "affected",
              "version": "e8de370188d098bb49483c287b44925957c3c9b6",
              "versionType": "git"
            },
            {
              "lessThan": "9a9929ec875ff20922c90c96fd544ae8a2a61a8d",
              "status": "affected",
              "version": "e8de370188d098bb49483c287b44925957c3c9b6",
              "versionType": "git"
            },
            {
              "lessThan": "e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0",
              "status": "affected",
              "version": "e8de370188d098bb49483c287b44925957c3c9b6",
              "versionType": "git"
            },
            {
              "lessThan": "211c68d817a3d9dc14c0026a59da7cac30f8147e",
              "status": "affected",
              "version": "e8de370188d098bb49483c287b44925957c3c9b6",
              "versionType": "git"
            },
            {
              "lessThan": "5cbef379a94b161726c5f504598bf4791d45cedc",
              "status": "affected",
              "version": "e8de370188d098bb49483c287b44925957c3c9b6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/rapidio/devices/rio_mport_cdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: mport_cdev: fix use-after-free in dma_req_free()\n\ndma_req_free() acquires buf_mutex through req-\u003emap, drops the mapping\nreference with kref_put(), and then dereferences req-\u003emap again to unlock\nthe mutex.\n\nIf kref_put() drops the last reference, mport_release_mapping() frees the\nmapping, and the subsequent mutex_unlock() dereferences a freed object. \nThis is a use-after-free.\n\nFix this by caching map and md before kref_put(), clearing req-\u003emap while\nholding buf_mutex, and using the cached md for mutex unlocking.\n\nThe bug is reachable from userspace via the RapidIO mport character device\ninterface."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The use-after-free is reached only through local ioctls on /dev/rio_mportN (RIO_ALLOC_DMA, RIO_TRANSFER with a kernel DMA handle, RIO_FREE_DMA, then close or RIO_WAIT_FOR_ASYNC). RapidIO is a board-level fabric, and this dma_req_free() path is not driven by received packets.\nAC:L - An attacker who can open the mport node deterministically allocates a DMA mapping, submits an async RIO_TRANSFER that takes a kref on it, drops the owner ref with RIO_FREE_DMA, then frees the request so dma_req_free() performs the last kref_put(); no condition outside the attacker\u2019s control is required.\nPR:L - mport_cdev_open() and the DMA ioctls perform no capable() checks; access is gated only by /dev/rio_mportN permissions, and RapidIO deployments commonly give fabric-management daemons group access to that node, so an unprivileged local user with the device can drive the bug.\nUI:N - Exploitation is entirely self-driven via the attacker\u2019s own open/ioctl/close sequence on the mport character device; no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The freed rio_mport_mapping and the subsequent mutex unlock occur in kernel heap within the host OS authority; this is a standard kernel use-after-free and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - dma_req_free() dereferences req-\u003emap after mport_release_mapping() has kfree\u2019d that kmalloc object; reclaiming the slab lets an attacker control map-\u003emd and read through the dangling pointer, a classic use-after-free disclosure primitive.\nI:H - Unlocking buf_mutex via a reclaimed map-\u003emd causes mutex_unlock() on an attacker-chosen address (fake-mutex wait_list write), so the use-after-free is exploitable for arbitrary kernel write and control-flow hijack.\nA:H - Use-after-free of rio_mport_mapping during mutex_unlock() oopses or panics under slab poisoning or init_on_free, and targeting a fake md leaves the real buf_mutex locked, deadlocking mapping paths and crashing or hanging the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:02:25.695Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc79c07cdcde02c5b17633d78777de6ac2c14b29"
        },
        {
          "url": "https://git.kernel.org/stable/c/26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd8881c24a9520f9c3d3e855d866197f63e471a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a9929ec875ff20922c90c96fd544ae8a2a61a8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/211c68d817a3d9dc14c0026a59da7cac30f8147e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5cbef379a94b161726c5f504598bf4791d45cedc"
        }
      ],
      "title": "rapidio: mport_cdev: fix use-after-free in dma_req_free()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89742",
    "datePublished": "2026-09-11T19:46:48.522Z",
    "dateReserved": "2026-09-11T19:38:34.761Z",
    "dateUpdated": "2026-09-14T12:02:25.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89742",
      "date": "2026-09-15",
      "epss": "0.00159",
      "percentile": "0.05454"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:49:47.000Z",
      "cve": "CVE-2026-89742",
      "id": "msrc_CVE-2026-89742",
      "initial_release_date": "2026-09-13T01:03:50.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "rapidio: mport_cdev: fix use-after-free in dma_req_free()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89742.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89742\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:04.863\",\"lastModified\":\"2026-09-14T13:19:23.040\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrapidio: mport_cdev: fix use-after-free in dma_req_free()\\n\\ndma_req_free() acquires buf_mutex through req-\u003emap, drops the mapping\\nreference with kref_put(), and then dereferences req-\u003emap again to unlock\\nthe mutex.\\n\\nIf kref_put() drops the last reference, mport_release_mapping() frees the\\nmapping, and the subsequent mutex_unlock() dereferences a freed object. \\nThis is a use-after-free.\\n\\nFix this by caching map and md before kref_put(), clearing req-\u003emap while\\nholding buf_mutex, and using the cached md for mutex unlocking.\\n\\nThe bug is reachable from userspace via the RapidIO mport character device\\ninterface.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/rapidio/devices/rio_mport_cdev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e8de370188d098bb49483c287b44925957c3c9b6\",\"lessThan\":\"00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8de370188d098bb49483c287b44925957c3c9b6\",\"lessThan\":\"fc79c07cdcde02c5b17633d78777de6ac2c14b29\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8de370188d098bb49483c287b44925957c3c9b6\",\"lessThan\":\"26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8de370188d098bb49483c287b44925957c3c9b6\",\"lessThan\":\"bd8881c24a9520f9c3d3e855d866197f63e471a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8de370188d098bb49483c287b44925957c3c9b6\",\"lessThan\":\"9a9929ec875ff20922c90c96fd544ae8a2a61a8d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8de370188d098bb49483c287b44925957c3c9b6\",\"lessThan\":\"e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8de370188d098bb49483c287b44925957c3c9b6\",\"lessThan\":\"211c68d817a3d9dc14c0026a59da7cac30f8147e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e8de370188d098bb49483c287b44925957c3c9b6\",\"lessThan\":\"5cbef379a94b161726c5f504598bf4791d45cedc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/rapidio/devices/rio_mport_cdev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/211c68d817a3d9dc14c0026a59da7cac30f8147e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5cbef379a94b161726c5f504598bf4791d45cedc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9a9929ec875ff20922c90c96fd544ae8a2a61a8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bd8881c24a9520f9c3d3e855d866197f63e471a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fc79c07cdcde02c5b17633d78777de6ac2c14b29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:47:58+00:00",
      "cve": "CVE-2026-89742",
      "id": "CVE-2026-89742",
      "initial_release_date": "2026-09-11T19:46:48.522000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Arbitrary code execution via use-after-free in RapidIO mport character device.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89742.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.