Cloudanix VulnDB

CVE-2026-90319

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in Linux could let a network setup failure leave behind a bad pointer that later crashes the system when hardware is removed.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Dangling pointer left in mport->net after rio_add_net() failure allows later mport unregister path to dereference and potentially double-free the rio_net object.

Why it matters to the business

Linux systems using the RapidIO subsystem risk kernel crashes or memory corruption leading to denial of service and operational downtime; low prevalence reduces overall exposure.

How an attack unfolds

An attacker triggers a failure in rio_add_net() during net allocation, leaves the dangling mport->net pointer, then forces an mport unregister to dereference the already-freed rio_net.

How to fix it

Update the Linux kernel to a version containing the fix that clears mport->net on rio_add_net() failure, matching the existing cleanup for destID table allocation errors.

How to confirm the fix worked

Inspect rapidio core code for the added mport->net = NULL assignment in the rio_add_net() error path and confirm the change is present after patching.

Typical attack path

  1. Cause rio_add_net() to fail during rio_scan_alloc_net()
  2. Trigger mport unregister path
  3. Dereference dangling mport->net pointer leading to use-after-free

How to detect it

Search kernel logs and crash dumps for rapidio mport unregister paths coinciding with prior rio_add_net failures; examine call traces involving rio_net release callbacks.

What your security team should do

  • Apply the upstream rapidio fix at the next kernel update window
  • Evaluate whether RapidIO hardware is present before prioritizing
  • Monitor kernel oops logs for rapidio-related use-after-free signatures

The record

In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport->net when rio_add_net() fails rio_alloc_net() stores the newly allocated rio_net in mport->net before rio_scan_alloc_net() registers the device. If rio_add_net() fails, rio_scan_alloc_net() drops the device reference with put_device(), which releases the rio_net through the device release callback. However, mport->net is left pointing at the freed object. A later mport unregister path can then dereference the dangling mport->net pointer and may try to free the same rio_net again. Clear mport->net in the rio_add_net() failure path, matching the cleanup done for the destID table allocation failure path.

Affected packages

Ecosystem Package Introduced Fixed