Strix
64.2K

CVE-2026-89742

HIGHCVSS 7.8/10EPSS 0.16%

Last modified

CVE-2026-89742 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.16%

5.4th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= e8de370188d098bb49483c287b44925957c3c9b6, < 00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a; >= e8de370188d098bb49483c287b44925957c3c9b6, < fc79c07cdcde02c5b17633d78777de6ac2c14b29; >= e8de370188d098bb49483c287b44925957c3c9b6, < 26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6; >= e8de370188d098bb49483c287b44925957c3c9b6, < bd8881c24a9520f9c3d3e855d866197f63e471a7; >= e8de370188d098bb49483c287b44925957c3c9b6, < 9a9929ec875ff20922c90c96fd544ae8a2a61a8d; >= e8de370188d098bb49483c287b44925957c3c9b6, < e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0; >= e8de370188d098bb49483c287b44925957c3c9b6, < 211c68d817a3d9dc14c0026a59da7cac30f8147e; >= e8de370188d098bb49483c287b44925957c3c9b6, < 5cbef379a94b161726c5f504598bf4791d45cedc
LinuxLinux4.6

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-89742?
In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.
How severe is CVE-2026-89742?
CVE-2026-89742 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2026-89742?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-89742?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST