Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90319— rapidio: clear mport->net when rio_add_net() fails

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： rapidio: 在 失败时清除 会在 注册设备之前，将新分配的 存储到 中。 如果 调用失败， 会通过 释放设备引用，进而通过设备释放回调函数释放 对象。然而， 指针仍指向该已释放的对象。 随后， 注销路径可能会解引用这个悬空的 指针，并可能尝试再次释放同一个 ，从而导致双重释放（double-free）问题。 修复方案：在 失败的路径中清除 ，与处理 destID 表分配失败路径时的清理逻辑保持一致。

AI Predicted 6.1 Difficulty: Hard EPSS 0.21% · P10

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 27

VendorProduct Version RangeStatus
Linux Linux 4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7< 24f60ebabeb8757cec8ec2f97660d521bc9147ec affected
181d4daaefb3bceeb2f2635ba9f3781eeda9e550< 6a760a53e73064735cdfa9e51c664983a89baf96 affected
ad82be4298a89a9ae46f07128bdf3d8614bce745< 3f00999e44d9984036a029dbad9d2afe94a674d0 affected
e6411c3b9512dba09af7d014d474516828c89706< 332591a245de978349a7558f8b20469951bb77cc affected
c332f3e2df0fcae5a45fd55cc18902fb1e4825ca< 75f0bc167b96bbbef8182b88308c732af82c8d83 affected
e842f9a1edf306bf36fe2a4d847a0b0d458770de< 44a37264b26911e13d0a4f5630751c4157ed0354 affected
e842f9a1edf306bf36fe2a4d847a0b0d458770de< 530a9d5ef831a0049dad9a6b2b92d02301352c38 affected
e842f9a1edf306bf36fe2a4d847a0b0d458770de< b74030fbf187b43c1f85b66a7082e9946511cb5d affected
… +19 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90319

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
rapidio: clear mport->net when rio_add_net() fails
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport->net when rio_add_net() fails rio_alloc_net() stores the newly allocated rio_net in mport->net before rio_scan_alloc_net() registers the device. If rio_add_net() fails, rio_scan_alloc_net() drops the device reference with put_device(), which releases the rio_net through the device release callback. However, mport->net is left pointing at the freed object. A later mport unregister path can then dereference the dangling mport->net pointer and may try to free the same rio_net again. Clear mport->net in the rio_add_net() failure path, matching the cleanup done for the destID table allocation failure path.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7 ~ 24f60ebabeb8757cec8ec2f97660d521bc9147ec -
Linux Linux 6.14 -

II. Public POCs for CVE-2026-90319

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90319

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90319 (7)

Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total

CVE-2026-92489 9.8 CRITICAL xfrm: Fix skb double-free in xfrm_dev_direct_output()
CVE-2026-90104 9.8 CRITICAL NFSv4.1: zero referring call lists before decoding
CVE-2026-90235 9.8 CRITICAL sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
CVE-2026-90173 9.8 CRITICAL smb: smbdirect: free completion queues with ib_free_cq()
CVE-2026-90151 9.8 CRITICAL NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90110 9.4 CRITICAL inetpeer: randomize RB-tree node comparison using SipHash
CVE-2026-90413 9.1 CRITICAL IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90414 9.1 CRITICAL IB/isert: reject PDUs declaring more data than was received
CVE-2026-90230 9.1 CRITICAL nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
CVE-2026-90256 8.8 HIGH Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
CVE-2026-90357 8.8 HIGH wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
CVE-2026-90286 8.8 HIGH drm/amdgpu/gfx6: Use PFP on the compute queues too
CVE-2026-90381 8.8 HIGH wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
CVE-2026-90380 8.8 HIGH wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
CVE-2026-90329 8.8 HIGH HID: synchronize input before cleaning up a failed probe
CVE-2026-93042 8.8 HIGH dmaengine: dw-edma: Terminate all descriptors without callbacks
CVE-2026-90162 8.8 HIGH ksmbd: defer publishing granted locks to prevent UAF/double-free race
CVE-2026-90379 8.8 HIGH wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
CVE-2026-90367 8.8 HIGH wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
CVE-2026-90371 8.8 HIGH wifi: mt76: fix RXDMAD_C buffer recycling race

Showing top 20 of 600 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90319

No comments yet

Leave a comment