GHSA-2X23-JXCH-R563
Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-17 18:32In the Linux kernel, the following vulnerability has been resolved:
rapidio: clear mport->net when rio_add_net() fails
rio_alloc_net() stores the newly allocated rio_net in mport->net before rio_scan_alloc_net() registers the device.
If rio_add_net() fails, rio_scan_alloc_net() drops the device reference with put_device(), which releases the rio_net through the device release callback. However, mport->net is left pointing at the freed object.
A later mport unregister path can then dereference the dangling mport->net pointer and may try to free the same rio_net again.
Clear mport->net in the rio_add_net() failure path, matching the cleanup done for the destID table allocation failure path.
{
"affected": [],
"aliases": [
"CVE-2026-90319"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:29Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: clear mport-\u003enet when rio_add_net() fails\n\nrio_alloc_net() stores the newly allocated rio_net in mport-\u003enet before\nrio_scan_alloc_net() registers the device.\n\nIf rio_add_net() fails, rio_scan_alloc_net() drops the device reference\nwith put_device(), which releases the rio_net through the device release\ncallback. However, mport-\u003enet is left pointing at the freed object.\n\nA later mport unregister path can then dereference the dangling mport-\u003enet\npointer and may try to free the same rio_net again.\n\nClear mport-\u003enet in the rio_add_net() failure path, matching the cleanup\ndone for the destID table allocation failure path.",
"id": "GHSA-2x23-jxch-r563",
"modified": "2026-09-17T18:32:01Z",
"published": "2026-09-17T18:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90319"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/24f60ebabeb8757cec8ec2f97660d521bc9147ec"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/332591a245de978349a7558f8b20469951bb77cc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3f00999e44d9984036a029dbad9d2afe94a674d0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/44a37264b26911e13d0a4f5630751c4157ed0354"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/530a9d5ef831a0049dad9a6b2b92d02301352c38"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6a760a53e73064735cdfa9e51c664983a89baf96"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/75f0bc167b96bbbef8182b88308c732af82c8d83"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b74030fbf187b43c1f85b66a7082e9946511cb5d"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.