{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90319","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-11T19:38:34.801Z","datePublished":"2026-09-17T16:08:36.840Z","dateUpdated":"2026-09-17T16:08:36.840Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-17T16:08:36.840Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: clear mport->net when rio_add_net() fails\n\nrio_alloc_net() stores the newly allocated rio_net in mport->net before\nrio_scan_alloc_net() registers the device.\n\nIf rio_add_net() fails, rio_scan_alloc_net() drops the device reference\nwith put_device(), which releases the rio_net through the device release\ncallback.  However, mport->net is left pointing at the freed object.\n\nA later mport unregister path can then dereference the dangling mport->net\npointer and may try to free the same rio_net again.\n\nClear mport->net in the rio_add_net() failure path, matching the cleanup\ndone for the destID table allocation failure path."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/rapidio/rio-scan.c"],"versions":[{"version":"4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7","lessThan":"24f60ebabeb8757cec8ec2f97660d521bc9147ec","status":"affected","versionType":"git"},{"version":"181d4daaefb3bceeb2f2635ba9f3781eeda9e550","lessThan":"6a760a53e73064735cdfa9e51c664983a89baf96","status":"affected","versionType":"git"},{"version":"ad82be4298a89a9ae46f07128bdf3d8614bce745","lessThan":"3f00999e44d9984036a029dbad9d2afe94a674d0","status":"affected","versionType":"git"},{"version":"e6411c3b9512dba09af7d014d474516828c89706","lessThan":"332591a245de978349a7558f8b20469951bb77cc","status":"affected","versionType":"git"},{"version":"c332f3e2df0fcae5a45fd55cc18902fb1e4825ca","lessThan":"75f0bc167b96bbbef8182b88308c732af82c8d83","status":"affected","versionType":"git"},{"version":"e842f9a1edf306bf36fe2a4d847a0b0d458770de","lessThan":"44a37264b26911e13d0a4f5630751c4157ed0354","status":"affected","versionType":"git"},{"version":"e842f9a1edf306bf36fe2a4d847a0b0d458770de","lessThan":"530a9d5ef831a0049dad9a6b2b92d02301352c38","status":"affected","versionType":"git"},{"version":"e842f9a1edf306bf36fe2a4d847a0b0d458770de","lessThan":"b74030fbf187b43c1f85b66a7082e9946511cb5d","status":"affected","versionType":"git"},{"version":"6d22953c4a183d0b7fdf34d68c5debd16da6edc5","status":"affected","versionType":"git"},{"version":"a0d069ccc475abaaa79c6368ee27fc0b5912bea8","status":"affected","versionType":"git"},{"version":"5.10.235","lessThan":"5.10.270","status":"affected","versionType":"semver"},{"version":"5.15.179","lessThan":"5.15.221","status":"affected","versionType":"semver"},{"version":"6.1.131","lessThan":"6.1.188","status":"affected","versionType":"semver"},{"version":"6.6.83","lessThan":"6.6.157","status":"affected","versionType":"semver"},{"version":"6.12.19","lessThan":"6.12.110","status":"affected","versionType":"semver"},{"version":"5.4.291","lessThan":"5.5","status":"affected","versionType":"semver"},{"version":"6.13.7","lessThan":"6.14","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/rapidio/rio-scan.c"],"versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","status":"unaffected","versionType":"semver"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.235","versionEndExcluding":"5.10.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.179","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.131","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.83","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.19","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.3-rc1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.291"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13.7"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/24f60ebabeb8757cec8ec2f97660d521bc9147ec"},{"url":"https://git.kernel.org/stable/c/6a760a53e73064735cdfa9e51c664983a89baf96"},{"url":"https://git.kernel.org/stable/c/3f00999e44d9984036a029dbad9d2afe94a674d0"},{"url":"https://git.kernel.org/stable/c/332591a245de978349a7558f8b20469951bb77cc"},{"url":"https://git.kernel.org/stable/c/75f0bc167b96bbbef8182b88308c732af82c8d83"},{"url":"https://git.kernel.org/stable/c/44a37264b26911e13d0a4f5630751c4157ed0354"},{"url":"https://git.kernel.org/stable/c/530a9d5ef831a0049dad9a6b2b92d02301352c38"},{"url":"https://git.kernel.org/stable/c/b74030fbf187b43c1f85b66a7082e9946511cb5d"}],"title":"rapidio: clear mport->net when rio_add_net() fails","x_generator":{"engine":"bippy-1.2.0"}}}}