« Volver al listado

CVE-2026-90319

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

rapidio: clear mport->net when rio_add_net() fails

rio_alloc_net() stores the newly allocated rio_net in mport->net before rio_scan_alloc_net() registers the device.

If rio_add_net() fails, rio_scan_alloc_net() drops the device reference with put_device(), which releases the rio_net through the device release callback. However, mport->net is left pointing at the freed object.

A later mport unregister path can then dereference the dangling mport->net pointer and may try to free the same rio_net again.

Clear mport->net in the rio_add_net() failure path, matching the cleanup done for the destID table allocation failure path.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90319",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7",
              "lessThan": "24f60ebabeb8757cec8ec2f97660d521bc9147ec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "181d4daaefb3bceeb2f2635ba9f3781eeda9e550",
              "lessThan": "6a760a53e73064735cdfa9e51c664983a89baf96",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ad82be4298a89a9ae46f07128bdf3d8614bce745",
              "lessThan": "3f00999e44d9984036a029dbad9d2afe94a674d0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e6411c3b9512dba09af7d014d474516828c89706",
              "lessThan": "332591a245de978349a7558f8b20469951bb77cc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c332f3e2df0fcae5a45fd55cc18902fb1e4825ca",
              "lessThan": "75f0bc167b96bbbef8182b88308c732af82c8d83",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e842f9a1edf306bf36fe2a4d847a0b0d458770de",
              "lessThan": "44a37264b26911e13d0a4f5630751c4157ed0354",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e842f9a1edf306bf36fe2a4d847a0b0d458770de",
              "lessThan": "530a9d5ef831a0049dad9a6b2b92d02301352c38",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e842f9a1edf306bf36fe2a4d847a0b0d458770de",
              "lessThan": "b74030fbf187b43c1f85b66a7082e9946511cb5d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6d22953c4a183d0b7fdf34d68c5debd16da6edc5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a0d069ccc475abaaa79c6368ee27fc0b5912bea8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.10.235",
              "lessThan": "5.10.270",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.15.179",
              "lessThan": "5.15.221",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.1.131",
              "lessThan": "6.1.188",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.6.83",
              "lessThan": "6.6.157",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.12.19",
              "lessThan": "6.12.110",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.4.291",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.13.7",
              "lessThan": "6.14",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "drivers/rapidio/rio-scan.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/rapidio/rio-scan.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:29.817",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/24f60ebabeb8757cec8ec2f97660d521bc9147ec",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/332591a245de978349a7558f8b20469951bb77cc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3f00999e44d9984036a029dbad9d2afe94a674d0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/44a37264b26911e13d0a4f5630751c4157ed0354",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/530a9d5ef831a0049dad9a6b2b92d02301352c38",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6a760a53e73064735cdfa9e51c664983a89baf96",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/75f0bc167b96bbbef8182b88308c732af82c8d83",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b74030fbf187b43c1f85b66a7082e9946511cb5d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: clear mport->net when rio_add_net() fails\n\nrio_alloc_net() stores the newly allocated rio_net in mport->net before\nrio_scan_alloc_net() registers the device.\n\nIf rio_add_net() fails, rio_scan_alloc_net() drops the device reference\nwith put_device(), which releases the rio_net through the device release\ncallback.  However, mport->net is left pointing at the freed object.\n\nA later mport unregister path can then dereference the dangling mport->net\npointer and may try to free the same rio_net again.\n\nClear mport->net in the rio_add_net() failure path, matching the cleanup\ndone for the destID table allocation failure path."
    }
  ],
  "lastModified": "2026-09-17T17:17:29.817",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}