CVE-2026-89764: Linux Kernel Race Condition Vulnerability

CVE-2026-89764 Overview

CVE-2026-89764 is a race condition vulnerability in the Linux kernel's Rust devres (device resource) implementation. Two concurrent revocation paths can trigger a use-after-free when releasing a Devres object. The driver core's devres_release_all() invokes Revocable::revoke() through the release callback on one CPU while Devres::drop() calls revoke_nosync() on another. The revoker that loses the is_available atomic swap returns immediately, but the winner may still be executing drop_in_place() on the wrapped inner data. Adjacent resources referenced by drop_in_place() can be freed prematurely, producing memory corruption. A documented scenario involves Devres<DmaMappedSgt> racing with SGTable freeing the backing sg_table and pages.

Critical Impact
A local, low-privileged user can trigger a use-after-free in kernel memory, leading to potential kernel-level code execution, privilege escalation, or system compromise.

Affected Products

Linux kernel builds enabling Rust support and the devres abstraction
Kernel drivers written in Rust that rely on Devres for device resource management
Downstream distributions shipping vulnerable kernel commits prior to the fix

Discovery Timeline

2026-09-11 - CVE-2026-89764 published to the National Vulnerability Database (NVD)
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89764

Vulnerability Analysis

The defect is a classic race condition [CWE-362] that escalates into a use-after-free [CWE-416] within the Rust devres abstraction. Devres wraps device-bound resources and revokes them either when the device is unbound or when the Devres object is dropped. Both revocation paths coordinate through an atomic is_available flag. The path that successfully swaps the flag performs the actual teardown by executing drop_in_place() on the inner data. The losing path assumes teardown is either complete or in progress and returns immediately.

This assumption is unsafe. When Devres::drop() loses the swap and returns, its caller proceeds to drop adjacent resources that the winning revoker's drop_in_place() still holds references to. In the reported case, an SGTable releases its backing scatter-gather table and pages while DmaMappedSgt teardown remains active, producing dangling pointer access inside the kernel.

Root Cause

The root cause is missing synchronization between the two revocation completion points. The atomic swap on is_available provides mutual exclusion for who performs the drop, but not a happens-before edge for callers that depend on the drop having finished.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker triggers concurrent revocation of a Devres object, typically by racing device unbind operations against normal object lifetime events in a Rust-based driver that exposes Devres-managed DMA or scatter-gather resources. Successful races yield a kernel use-after-free that can be shaped into privilege escalation.

No public exploit or proof-of-concept has been published for CVE-2026-89764 at the time of writing.

Detection Methods for CVE-2026-89764

Indicators of Compromise

Kernel oops, BUG, or KASAN reports referencing Devres, Revocable::revoke, revoke_nosync, or drop_in_place frames
Unexpected use-after-free reports involving sg_table or DMA mapping teardown paths in Rust drivers
Repeated device unbind/rebind cycles preceding kernel instability on hosts running Rust-enabled kernels

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_KERNEL on test kernels to surface use-after-free access during driver stress tests
Correlate kernel crash telemetry with process activity that repeatedly opens, closes, or rebinds devices backed by Rust drivers
Track kernel version and patch-level inventory to identify hosts running commits prior to c7e3d57 / acc516d

Monitoring Recommendations

Forward dmesg, journald, and kdump artifacts to a central data lake for retention and correlation
Alert on any local user process associated with kernel panics involving devres or DMA teardown
Monitor for unusual sysfs writes to bind/unbind attributes performed by non-root or containerized workloads

How to Mitigate CVE-2026-89764

Immediate Actions Required

Apply upstream kernel commits acc516d and c7e3d57 or the vendor-provided backport
Prioritize patching multi-tenant Linux hosts and systems allowing local shell access
Restrict local access on systems that cannot be immediately patched

Patch Information

The upstream fix introduces a Completion primitive to synchronize the two revocation paths. The release callback signals the Completion after revoke() finishes, and Devres::drop() waits on it when it loses the is_available swap. This guarantees the wrapped object is fully torn down before Devres::drop() returns, closing the race window. Fixes are available in the Linux kernel stable tree commit acc516d and commit c7e3d57.

Workarounds

Disable or avoid loading Rust-based drivers that manage device resources through Devres until the kernel is patched
Restrict CAP_SYS_ADMIN and access to sysfs bind/unbind interfaces to trusted administrators only
Limit local logon rights on shared hosts to reduce exposure to the local attack vector

bash

# Verify running kernel version and check for the fix
uname -r

# Restrict unprivileged access to driver bind/unbind sysfs entries
find /sys/bus/*/drivers/*/ -maxdepth 1 -name 'bind' -o -name 'unbind' \
  | xargs -I{} chmod 600 {}