CVE-2026-89764

A race condition exists in the Linux kernel's Rust devres (device-managed resource) abstraction: when the driver core's devres_release_all() revokes a Devres via its release callback while Devres::drop() revokes it concurrently on another CPU, the revoker that loses the is_available swap can return while drop_in_place() is still tearing down the inner data, producing a use-after-free on adjacent resources such as the sg_table and pages backing an SGTable. Because this is a local kernel memory-corruption flaw (CVSS 3.1: 7.8, AV:L/PR:L), a local attacker with limited privileges on an affected machine could potentially escalate privileges or crash the kernel, though triggering it requires winning the race during a concurrent device-resource teardown. Only kernels built with the experimental Rust support that includes the devres abstraction (and drivers actually using it) are affected — typical distribution kernels without CONFIG_RUST are not. There is no known public proof of concept, the issue is not in CISA's KEV catalog, and no exploitation in the wild has been reported. The fix adds a Completion so that Devres::drop() waits until the wrapped object is fully destroyed before returning.

What to do: Apply kernel updates from your distribution or vendor once a release containing this fix is available. Check whether your kernel is built with CONFIG_RUST and runs Rust-based drivers — systems without Rust kernel support are not exposed to this code path. Monitor vendor advisories for backports of the upstream rust: devres patch that adds the Completion synchronization.