{"id":"AZL-100718","summary":"CVE-2026-89742 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: mport_cdev: fix use-after-free in dma_req_free()\n\ndma_req_free() acquires buf_mutex through req-\u003emap, drops the mapping\nreference with kref_put(), and then dereferences req-\u003emap again to unlock\nthe mutex.\n\nIf kref_put() drops the last reference, mport_release_mapping() frees the\nmapping, and the subsequent mutex_unlock() dereferences a freed object. \nThis is a use-after-free.\n\nFix this by caching map and md before kref_put(), clearing req-\u003emap while\nholding buf_mutex, and using the cached md for mutex unlocking.\n\nThe bug is reachable from userspace via the RapidIO mport character device\ninterface.","modified":"2026-09-12T14:15:32.643186067Z","published":"2026-09-11T20:20:04Z","upstream":["CVE-2026-89742"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89742"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100718.json"}}],"schema_version":"1.9.0"}