GHSA-V69R-W76R-QV39
Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-18 18:31In the Linux kernel, the following vulnerability has been resolved:
uio: Fix stale info pointer in failed registration path
After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info.
That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev->info and dereference freed memory.
Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uio_unregister_device().
{
"affected": [],
"aliases": [
"CVE-2026-93054"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:58Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio: Fix stale info pointer in failed registration path\n\nAfter device_add(), the UIO device is visible to userspace and /dev/uioX\ncan be opened. If a later setup step fails, __uio_register_device()\nunwinds the device but leaves idev-\u003einfo pointing at the caller-owned\nstruct uio_info.\n\nThat is unsafe when an opener races with the failed registration path.\nThe open file keeps a reference to the uio_device, while the caller sees\nregistration failure and may free its struct uio_info. Later file\noperations can then follow idev-\u003einfo and dereference freed memory.\n\nHandle post-device_add() failures like unregister: remove UIO attributes\nwhile the info pointer is still valid, then clear idev-\u003einfo under\ninfo_lock and wake existing waiters/async users before removing the\ndevice and minor. This makes already-open file descriptors observe the\nsame \"device gone\" state as normal uio_unregister_device().",
"id": "GHSA-v69r-w76r-qv39",
"modified": "2026-09-18T18:31:33Z",
"published": "2026-09-17T18:32:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93054"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/15340b00e665af805523b08515294a1aa1778151"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/16695e9059d80ea6661e8399064b0c01f641dd8c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/506b43dde5f9ac0068b1360e6b5dbee07fda59fb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/63eaa7663335d482a8825c231213e312cacea567"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/67b6fc084b034a91c3ec7907a3fed89a2450f30b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/df4faf65194ec6c315a59be4c6749eaeb3009243"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ec5bd6731183eb6f619140c9bef2ee11ed818c20"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.