CVE-2026-93054
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
uio: Fix stale info pointer in failed registration path
In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info. That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev->info and dereference freed memory. Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uio_unregister_device().
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| a93e7b331568227500186a465fee3c2cb5dffd1f | affected | git | 63eaa7663335d482a8825c231213e312cacea567 | Unavailable | None listed |
| a93e7b331568227500186a465fee3c2cb5dffd1f | affected | git | df4faf65194ec6c315a59be4c6749eaeb3009243 | Unavailable | None listed |
| a93e7b331568227500186a465fee3c2cb5dffd1f | affected | git | 506b43dde5f9ac0068b1360e6b5dbee07fda59fb | Unavailable | None listed |
| a93e7b331568227500186a465fee3c2cb5dffd1f | affected | git | 15340b00e665af805523b08515294a1aa1778151 | Unavailable | None listed |
| a93e7b331568227500186a465fee3c2cb5dffd1f | affected | git | 234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac | Unavailable | None listed |
| a93e7b331568227500186a465fee3c2cb5dffd1f | affected | git | 16695e9059d80ea6661e8399064b0c01f641dd8c | Unavailable | None listed |
| a93e7b331568227500186a465fee3c2cb5dffd1f | affected | git | ec5bd6731183eb6f619140c9bef2ee11ed818c20 | Unavailable | None listed |
| a93e7b331568227500186a465fee3c2cb5dffd1f | affected | git | 67b6fc084b034a91c3ec7907a3fed89a2450f30b | Unavailable | None listed |
| 085d735c858934e5d5bfaedb1fc98bd9135e6ff1 | affected | git | Unavailable | Unavailable | None listed |
| 4.14.100 | affected | semver | 4.15 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.18 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 4.18 | Unavailable | None listed |
| 5.10.270 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.221 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.188 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.157 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.110 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.52 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.6 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |