HIGH Introduced in 4.6
rapidio DmaReq UAF
CVE-2026-89742
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.
02KernelScan AI Analysis
Risk summary
A use-after-free in the RapidIO mport character device driver allows a local root user with access to the device node to corrupt kernel memory, potentially leading to privilege escalation or denial of service. The vulnerability requires RapidIO hardware to be present and the mport_cdev module loaded, which is typical only in industrial or embedded systems. Exploitation could result in arbitrary kernel read/write access or a system crash.
Vulnerability analysis
When freeing a DMA request through the RapidIO mport character device, the cleanup code drops a reference count on a mapping object and then attempts to unlock a mutex by dereferencing that same mapping object. If the reference count drop was the last one, the mapping is freed before the mutex unlock occurs, causing the unlock to access freed memory. The fix caches the mapping and device pointers in local variables before dropping the reference, so the mutex can be safely unlocked even after the mapping is freed. The bug is reachable from userspace via the RapidIO mport character device interface, which requires root-level access to the device node and the presence of RapidIO hardware in the system.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.6 | 5.10.270 | 00c5ed913b0d |
| 5.15 | 4.6 | 5.15.221 | fc79c07cdcde |
| 6.1 | 4.6 | 6.1.188 | 26ccfe7d69e2 |
| 6.12 | 4.6 | 6.12.109 | 9a9929ec875f |
| 6.18 | 4.6 | 6.18.50 | e6e925cc1f80 |
| 6.6 | 4.6 | 6.6.157 | bd8881c24a95 |
| 7.2 | 4.6 | 7.2.4 | 211c68d817a3 |
| mainline | 4.6 | 7.3 | 5cbef379a94b |
| cip/5.10 | 4.6 | 5.10.271-cip78 | 00c5ed913b0d |
| cip/6.1 | 4.6 | 6.1.189-cip61 | 26ccfe7d69e2 |
| cip/6.1-rt | 4.6 | 6.1.189-cip61-rt32 | 26ccfe7d69e2 |
| cip/6.12 | 4.6 | 6.12.111-cip32 | 9a9929ec875f |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |