CVE-2026-89742 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.

Is your site exposed to CVE-2026-89742?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0016

Probability of exploitation

0.05%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/00c5ed913b0dc563fbeb8a97ea8916c03bbbbf6a https://git.kernel.org/stable/c/211c68d817a3d9dc14c0026a59da7cac30f8147e https://git.kernel.org/stable/c/26ccfe7d69e27b0d933ae0a64a23a0cb9b9a85a6 https://git.kernel.org/stable/c/5cbef379a94b161726c5f504598bf4791d45cedc https://git.kernel.org/stable/c/9a9929ec875ff20922c90c96fd544ae8a2a61a8d https://git.kernel.org/stable/c/bd8881c24a9520f9c3d3e855d866197f63e471a7 https://git.kernel.org/stable/c/e6e925cc1f8067c65c7bec3da50a0ead3b3ef4e0 https://git.kernel.org/stable/c/fc79c07cdcde02c5b17633d78777de6ac2c14b29

Frequently Asked Questions

What is CVE-2026-89742? +

In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-89742? +

CVE-2026-89742 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0016, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-89742? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-89742