CVE-2026-90319: rapidio: clear mport->net when rio_add_net() fails

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-17 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport->net when rio_add_net() fails rio_alloc_net() stores the newly allocated rio_net in mport->net before rio_scan_alloc_net() registers the device. If rio_add_net() fails, rio_scan_alloc_net() drops the device reference with put_device(), which releases the rio_net through the device release callback. However, mport->net is left pointing at the freed object. A later mport unregister path can then dereference the dangling mport->net pointer and may try to free the same rio_net again. Clear mport->net in the rio_add_net() failure path, matching the cleanup done for the destID table allocation failure path.

Affected products

Linux kernel: from 5.10.235 before 5.10.270; from 5.15.179 before 5.15.221; from 6.1.131 before 6.1.188; from 6.6.83 before 6.6.157; from 6.12.19 before 6.12.110; from 5.4.291 before 5.5 — fixed in 5.10.270, 5.15.221, 5.5, 6.1.188, 6.12.110, 6.14

How to fix

Upgrade to a fixed version: Linux kernel 5.10.270, 5.15.221, 5.5, 6.1.188. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-90319 or the next vulnerability affects your stack