CVE-2026-89742: Linux Kernel RapidIO Use-After-Free

CVE-2026-89742 Overview

CVE-2026-89742 is a use-after-free vulnerability in the Linux kernel's RapidIO mport_cdev character device driver. The flaw resides in the dma_req_free() function, which dereferences a mapping structure after releasing its final reference count. Local users with access to the RapidIO mport character device interface can trigger the condition from userspace. Successful exploitation can lead to kernel memory corruption, denial of service, or local privilege escalation.

Critical Impact
A local, low-privileged user can trigger kernel memory corruption via the RapidIO mport character device, potentially resulting in privilege escalation to root.

Affected Products

Linux kernel builds with the RapidIO subsystem (CONFIG_RAPIDIO) and mport_cdev driver enabled
Distributions shipping vulnerable kernels prior to the fixes referenced in the stable tree commits
Systems exposing /dev/rio_mport* character devices to non-root users

Discovery Timeline

2026-09-11 - CVE-2026-89742 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89742

Vulnerability Analysis

The vulnerability lives in drivers/rapidio/devices/rio_mport_cdev.c within the dma_req_free() cleanup path. The function acquires buf_mutex via req->map, releases the mapping reference with kref_put(), and then dereferences req->map a second time to release the mutex. When kref_put() drops the final reference, mport_release_mapping() frees the mapping object. The subsequent mutex_unlock() operates on memory that has already been returned to the allocator, producing a use-after-free condition [CWE-416].

The fix caches both the map and md pointers before invoking kref_put(), clears req->map while still holding buf_mutex, and uses the cached md reference to perform the unlock. This ordering guarantees that the mutex object outlives the release path.

Root Cause

The root cause is an object lifetime bug. Code inside dma_req_free() assumes the mapping remains valid across the reference-decrement operation. Because kref_put() can synchronously invoke the release callback that frees the containing structure, any subsequent access through the same pointer is undefined behavior. The pattern violates standard kref usage guidance, which requires all references to the object to be resolved before decrementing the final count.

Attack Vector

Exploitation is local and requires the ability to open the RapidIO mport character device (typically /dev/rio_mport*). A local user issues DMA-related ioctls that create buffer mappings and then triggers a request-free path where reference counts race to zero. Freeing the mapping while the unlock path still references it results in a UAF write through mutex_unlock(). Skilled attackers can shape kernel heap allocations to reclaim the freed slab object with attacker-controlled data, enabling kernel memory corruption and potential privilege escalation.

See the upstream fix commits, including Linux Kernel Commit 26ccfe7 and Linux Kernel Commit fc79c07, for technical details.

Detection Methods for CVE-2026-89742

Indicators of Compromise

Kernel oops or panic messages referencing dma_req_free, mport_release_mapping, or mutex_unlock in dmesg
KASAN reports flagging use-after-free in the rio_mport_cdev module
Unexpected processes with open handles to /dev/rio_mport* devices
Slab corruption warnings correlated with RapidIO ioctl activity

Detection Strategies

Enable KASAN on test kernels to catch UAF conditions in the RapidIO driver during fuzzing or QA
Audit which local users and services have read/write access to /dev/rio_mport* device nodes
Correlate crash telemetry with process ancestry to identify local exploitation attempts
Monitor loaded kernel modules for rapidio_mport_cdev on systems where RapidIO is not required

Monitoring Recommendations

Ship kernel logs to a centralized logging or SIEM tier and alert on oops or KASAN traces referencing RapidIO symbols
Track ioctl activity against RapidIO character devices from non-root UIDs
Alert on unexpected loading of the rapidio_mport_cdev module in production fleets

How to Mitigate CVE-2026-89742

Immediate Actions Required

Apply the upstream stable kernel updates that incorporate the referenced fix commits and reboot affected hosts
Restrict access to /dev/rio_mport* device nodes to trusted administrative accounts only
Unload or blacklist the rapidio_mport_cdev module on systems that do not require RapidIO functionality
Prioritize patching multi-tenant hosts and systems where untrusted local users can execute code

Patch Information

Upstream fixes are available in the Linux stable tree. Relevant commits include Linux Kernel Commit 00c5ed9, Linux Kernel Commit 211c68d, Linux Kernel Commit 26ccfe7, Linux Kernel Commit 5cbef37, Linux Kernel Commit 9a9929e, Linux Kernel Commit bd8881c, Linux Kernel Commit e6e925c, and Linux Kernel Commit fc79c07. Consult distribution advisories for backported package versions.

Workarounds

Blacklist the rapidio_mport_cdev module where RapidIO hardware is not present
Remove world-accessible permissions from /dev/rio_mport* device nodes via udev rules
Constrain local user access using mandatory access control policies such as SELinux or AppArmor

bash

# Configuration example: blacklist the vulnerable module and restrict device access
echo "blacklist rapidio_mport_cdev" | sudo tee /etc/modprobe.d/blacklist-rapidio.conf
sudo rmmod rapidio_mport_cdev 2>/dev/null || true

# Restrict device node permissions via udev
cat <<'EOF' | sudo tee /etc/udev/rules.d/90-rio-mport.rules
KERNEL=="rio_mport*", OWNER="root", GROUP="root", MODE="0600"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger