CVE-2026-89742

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89742
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89742.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-89742
Downstream
Related
Published
2026-09-11T19:46:48Z
Modified
2026-09-25T18:27:21Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
rapidio: mport_cdev: fix use-after-free in dma_req_free()
Details

In the Linux kernel, the following vulnerability has been resolved:

rapidio: mport_cdev: fix use-after-free in dma_req_free()

dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex.

If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free.

Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking.

The bug is reachable from userspace via the RapidIO mport character device interface.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89742.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e8de370188d098bb49483c287b44925957c3c9b6
Fixed
00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a
Fixed
fc79c07cdcde02c5b17633d78777de6ac2c14b29
Fixed
26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6
Fixed
bd8881c24a9520f9c3d3e855d866197f63e471a7
Fixed
9a9929ec875ff20922c90c96fd544ae8a2a61a8d
Fixed
e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0
Fixed
211c68d817a3d9dc14c0026a59da7cac30f8147e
Fixed
5cbef379a94b161726c5f504598bf4791d45cedc

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89742.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.6.0
Fixed
5.10.270
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.221
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.188
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.157
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.109
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.50
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89742.json"