CVE-2026-89742

The Linux kernel's RapidIO mport_cdev driver contains a use-after-free in dma_req_free(): the function takes buf_mutex via req->map, drops the mapping's reference count with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() releases the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() operates on freed memory. The bug is reachable from local userspace through the RapidIO mport character device, so an attacker with access to that device node (typically root or a permitted group) can trigger kernel memory corruption, potentially causing a crash or privilege escalation, consistent with the high CVSS 3.1 score of 7.8. Only systems that actually have RapidIO fabric hardware and load the mport_cdev driver are affected; typical servers, desktops, and phones are not. The flaw has been fixed upstream by caching the map pointer before kref_put() and clearing req->map under the lock, and there is no known exploitation or public proof of concept.

What to do: Apply a kernel update containing the rapidio mport_cdev fix as soon as your distribution ships it. On hosts that don't use RapidIO, blacklist the mport_cdev module (or ensure RapidIO support isn't compiled in), and verify with 'lsmod | grep mport' that it isn't loaded. Where the driver is needed, restrict permissions on the mport character device nodes (/dev/riport*, /dev/mport*) to root only, and monitor for local users issuing unexpected DMA mapping requests to those devices.