EUVD-2026-76654
GHSA-hcj7-cp6w-gvx9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access to /dev/mport* with low privilege required; no race needed; kernel UAF yields full C/I/A compromise.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
rapidio: mport_cdev: fix use-after-free in dma_req_free()
dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex.
If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free.
Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking.
The bug is reachable from userspace via the RapidIO mport character device interface.
AnalysisAI
Use-after-free in the Linux kernel's RapidIO mport character device driver allows a local low-privileged user to trigger kernel memory corruption via the DMA request teardown path. The flaw exists in dma_req_free(), where the mutex protecting a mapping object is unlocked through a pointer that may have already been freed by kref_put() invoking the last-reference destructor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a Linux kernel build with CONFIG_RAPIDIO and the rio_mport_cdev driver compiled in (not default on x86 general-purpose kernels); (2) physical or virtual RapidIO mport hardware present and enumerated so the character device /dev/mport* is created; (3) a local user account with read/write permission to /dev/mport* (typically requires root, a dedicated group, or a permissive udev rule). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 (High) and is well-calibrated: local access to the mport character device is required (AV:L/PR:L), no race condition is needed (AC:L), and a kernel-context UAF plausibly yields full host compromise (C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Linux kernel to a patched stable release: 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems with RapidIO support enabled and document their current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today