FKIE_CVE-2026-93054

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info. That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev->info and dereference freed memory. Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uio_unregister_device().
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/15340b00e665af805523b08515294a1aa1778151
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/16695e9059d80ea6661e8399064b0c01f641dd8c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/506b43dde5f9ac0068b1360e6b5dbee07fda59fb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/63eaa7663335d482a8825c231213e312cacea567
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/67b6fc084b034a91c3ec7907a3fed89a2450f30b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/df4faf65194ec6c315a59be4c6749eaeb3009243
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ec5bd6731183eb6f619140c9bef2ee11ed818c20
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/uio/uio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63eaa7663335d482a8825c231213e312cacea567",
              "status": "affected",
              "version": "a93e7b331568227500186a465fee3c2cb5dffd1f",
              "versionType": "git"
            },
            {
              "lessThan": "df4faf65194ec6c315a59be4c6749eaeb3009243",
              "status": "affected",
              "version": "a93e7b331568227500186a465fee3c2cb5dffd1f",
              "versionType": "git"
            },
            {
              "lessThan": "506b43dde5f9ac0068b1360e6b5dbee07fda59fb",
              "status": "affected",
              "version": "a93e7b331568227500186a465fee3c2cb5dffd1f",
              "versionType": "git"
            },
            {
              "lessThan": "15340b00e665af805523b08515294a1aa1778151",
              "status": "affected",
              "version": "a93e7b331568227500186a465fee3c2cb5dffd1f",
              "versionType": "git"
            },
            {
              "lessThan": "234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac",
              "status": "affected",
              "version": "a93e7b331568227500186a465fee3c2cb5dffd1f",
              "versionType": "git"
            },
            {
              "lessThan": "16695e9059d80ea6661e8399064b0c01f641dd8c",
              "status": "affected",
              "version": "a93e7b331568227500186a465fee3c2cb5dffd1f",
              "versionType": "git"
            },
            {
              "lessThan": "ec5bd6731183eb6f619140c9bef2ee11ed818c20",
              "status": "affected",
              "version": "a93e7b331568227500186a465fee3c2cb5dffd1f",
              "versionType": "git"
            },
            {
              "lessThan": "67b6fc084b034a91c3ec7907a3fed89a2450f30b",
              "status": "affected",
              "version": "a93e7b331568227500186a465fee3c2cb5dffd1f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "085d735c858934e5d5bfaedb1fc98bd9135e6ff1",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.100",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/uio/uio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio: Fix stale info pointer in failed registration path\n\nAfter device_add(), the UIO device is visible to userspace and /dev/uioX\ncan be opened. If a later setup step fails, __uio_register_device()\nunwinds the device but leaves idev-\u003einfo pointing at the caller-owned\nstruct uio_info.\n\nThat is unsafe when an opener races with the failed registration path.\nThe open file keeps a reference to the uio_device, while the caller sees\nregistration failure and may free its struct uio_info. Later file\noperations can then follow idev-\u003einfo and dereference freed memory.\n\nHandle post-device_add() failures like unregister: remove UIO attributes\nwhile the info pointer is still valid, then clear idev-\u003einfo under\ninfo_lock and wake existing waiters/async users before removing the\ndevice and minor. This makes already-open file descriptors observe the\nsame \"device gone\" state as normal uio_unregister_device()."
    }
  ],
  "id": "CVE-2026-93054",
  "lastModified": "2026-09-17T17:17:58.923",
  "metrics": {},
  "published": "2026-09-17T17:17:58.923",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/15340b00e665af805523b08515294a1aa1778151"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/16695e9059d80ea6661e8399064b0c01f641dd8c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/506b43dde5f9ac0068b1360e6b5dbee07fda59fb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/63eaa7663335d482a8825c231213e312cacea567"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/67b6fc084b034a91c3ec7907a3fed89a2450f30b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/df4faf65194ec6c315a59be4c6749eaeb3009243"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ec5bd6731183eb6f619140c9bef2ee11ed818c20"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.