CVE-2026-89742

What it actually does

Use-after-free in dma_req_free() where buf_mutex is acquired via req->map, kref_put() frees the mapping on last reference, and mutex_unlock() then dereferences the freed object.

Why it matters to the business

Local attackers on systems exposing the RapidIO mport character device can crash the kernel or achieve privilege escalation, resulting in full host compromise and service disruption.

How an attack unfolds

An attacker with access to the RapidIO mport character device performs DMA request operations that cause kref_put() to release the final reference; the subsequent mutex unlock dereferences the now-freed mapping object.

How to fix it

Apply the upstream kernel fix that caches map and md before kref_put(), clears req->map while holding buf_mutex, and uses the cached md for unlocking; rebuild and deploy the patched kernel.

How to confirm the fix worked

Inspect the dma_req_free() implementation for the cached-map and clear-before-unlock logic; confirm the vulnerable code path is no longer reachable via the mport character device.

Typical attack path

1. Open the RapidIO mport character device from userspace
2. Issue DMA request operations that acquire buf_mutex via req->map
3. Trigger kref_put() to drop the last reference and free the mapping
4. Execute the subsequent mutex_unlock on the freed object

How to detect it

Search kernel logs and audit trails for accesses to RapidIO mport character devices followed by oops, panic, or warning messages referencing dma_req_free or mport_release_mapping.

• /dev/rio_mport
• mport_cdev
• dma_req_free
• mport_release_mapping

What your security team should do

• Prioritize kernel upgrade on all hosts exposing RapidIO hardware
• Disable the RapidIO mport character device interface when not required
• Restrict device node permissions to the minimum necessary users
• Monitor kernel logs for rapidio-related oops or use-after-free warnings