{"id":"CVE-2026-90319","state":"PUBLISHED","title":"rapidio: clear mport->net when rio_add_net() fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: clear mport->net when rio_add_net() fails\n\nrio_alloc_net() stores the newly allocated rio_net in mport->net before\nrio_scan_alloc_net() registers the device.\n\nIf rio_add_net() fails, rio_scan_alloc_net() drops the device reference\nwith put_device(), which releases the rio_net through the device release\ncallback.  However, mport->net is left pointing at the freed object.\n\nA later mport unregister path can then dereference the dangling mport->net\npointer and may try to free the same rio_net again.\n\nClear mport->net in the rio_add_net() failure path, matching the cleanup\ndone for the destID table allocation failure path.","publishedAt":"2026-09-17T16:08:36.840Z","updatedAt":"2026-10-19T09:01:35.572Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7","status":"affected","lessThan":"24f60ebabeb8757cec8ec2f97660d521bc9147ec","versionType":"git"},{"version":"181d4daaefb3bceeb2f2635ba9f3781eeda9e550","status":"affected","lessThan":"6a760a53e73064735cdfa9e51c664983a89baf96","versionType":"git"},{"version":"ad82be4298a89a9ae46f07128bdf3d8614bce745","status":"affected","lessThan":"3f00999e44d9984036a029dbad9d2afe94a674d0","versionType":"git"},{"version":"e6411c3b9512dba09af7d014d474516828c89706","status":"affected","lessThan":"332591a245de978349a7558f8b20469951bb77cc","versionType":"git"},{"version":"c332f3e2df0fcae5a45fd55cc18902fb1e4825ca","status":"affected","lessThan":"75f0bc167b96bbbef8182b88308c732af82c8d83","versionType":"git"},{"version":"e842f9a1edf306bf36fe2a4d847a0b0d458770de","status":"affected","lessThan":"44a37264b26911e13d0a4f5630751c4157ed0354","versionType":"git"},{"version":"e842f9a1edf306bf36fe2a4d847a0b0d458770de","status":"affected","lessThan":"530a9d5ef831a0049dad9a6b2b92d02301352c38","versionType":"git"},{"version":"e842f9a1edf306bf36fe2a4d847a0b0d458770de","status":"affected","lessThan":"b74030fbf187b43c1f85b66a7082e9946511cb5d","versionType":"git"},{"version":"6d22953c4a183d0b7fdf34d68c5debd16da6edc5","status":"affected","versionType":"git"},{"version":"a0d069ccc475abaaa79c6368ee27fc0b5912bea8","status":"affected","versionType":"git"},{"version":"5.10.235","status":"affected","lessThan":"5.10.270","versionType":"semver"},{"version":"5.15.179","status":"affected","lessThan":"5.15.221","versionType":"semver"},{"version":"6.1.131","status":"affected","lessThan":"6.1.188","versionType":"semver"},{"version":"6.6.83","status":"affected","lessThan":"6.6.157","versionType":"semver"},{"version":"6.12.19","status":"affected","lessThan":"6.12.110","versionType":"semver"},{"version":"5.4.291","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"6.13.7","status":"affected","lessThan":"6.14","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/rapidio/rio-scan.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.14","versionType":"semver"},{"version":"5.10.270","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.221","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.188","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/rapidio/rio-scan.c"]}],"references":["https://git.kernel.org/stable/c/24f60ebabeb8757cec8ec2f97660d521bc9147ec","https://git.kernel.org/stable/c/6a760a53e73064735cdfa9e51c664983a89baf96","https://git.kernel.org/stable/c/3f00999e44d9984036a029dbad9d2afe94a674d0","https://git.kernel.org/stable/c/332591a245de978349a7558f8b20469951bb77cc","https://git.kernel.org/stable/c/75f0bc167b96bbbef8182b88308c732af82c8d83","https://git.kernel.org/stable/c/44a37264b26911e13d0a4f5630751c4157ed0354","https://git.kernel.org/stable/c/530a9d5ef831a0049dad9a6b2b92d02301352c38","https://git.kernel.org/stable/c/b74030fbf187b43c1f85b66a7082e9946511cb5d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90319.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90319","state":"PUBLISHED","datePublished":"2026-09-17T16:08:36.840Z","dateUpdated":"2026-10-19T09:01:35.572Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.801Z"},"containers":{"cna":{"title":"rapidio: clear mport->net when rio_add_net() fails","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: clear mport->net when rio_add_net() fails\n\nrio_alloc_net() stores the newly allocated rio_net in mport->net before\nrio_scan_alloc_net() registers the device.\n\nIf rio_add_net() fails, rio_scan_alloc_net() drops the device reference\nwith put_device(), which releases the rio_net through the device release\ncallback.  However, mport->net is left pointing at the freed object.\n\nA later mport unregister path can then dereference the dangling mport->net\npointer and may try to free the same rio_net again.\n\nClear mport->net in the rio_add_net() failure path, matching the cleanup\ndone for the destID table allocation failure path."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7","status":"affected","lessThan":"24f60ebabeb8757cec8ec2f97660d521bc9147ec","versionType":"git"},{"version":"181d4daaefb3bceeb2f2635ba9f3781eeda9e550","status":"affected","lessThan":"6a760a53e73064735cdfa9e51c664983a89baf96","versionType":"git"},{"version":"ad82be4298a89a9ae46f07128bdf3d8614bce745","status":"affected","lessThan":"3f00999e44d9984036a029dbad9d2afe94a674d0","versionType":"git"},{"version":"e6411c3b9512dba09af7d014d474516828c89706","status":"affected","lessThan":"332591a245de978349a7558f8b20469951bb77cc","versionType":"git"},{"version":"c332f3e2df0fcae5a45fd55cc18902fb1e4825ca","status":"affected","lessThan":"75f0bc167b96bbbef8182b88308c732af82c8d83","versionType":"git"},{"version":"e842f9a1edf306bf36fe2a4d847a0b0d458770de","status":"affected","lessThan":"44a37264b26911e13d0a4f5630751c4157ed0354","versionType":"git"},{"version":"e842f9a1edf306bf36fe2a4d847a0b0d458770de","status":"affected","lessThan":"530a9d5ef831a0049dad9a6b2b92d02301352c38","versionType":"git"},{"version":"e842f9a1edf306bf36fe2a4d847a0b0d458770de","status":"affected","lessThan":"b74030fbf187b43c1f85b66a7082e9946511cb5d","versionType":"git"},{"version":"6d22953c4a183d0b7fdf34d68c5debd16da6edc5","status":"affected","versionType":"git"},{"version":"a0d069ccc475abaaa79c6368ee27fc0b5912bea8","status":"affected","versionType":"git"},{"version":"5.10.235","status":"affected","lessThan":"5.10.270","versionType":"semver"},{"version":"5.15.179","status":"affected","lessThan":"5.15.221","versionType":"semver"},{"version":"6.1.131","status":"affected","lessThan":"6.1.188","versionType":"semver"},{"version":"6.6.83","status":"affected","lessThan":"6.6.157","versionType":"semver"},{"version":"6.12.19","status":"affected","lessThan":"6.12.110","versionType":"semver"},{"version":"5.4.291","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"6.13.7","status":"affected","lessThan":"6.14","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/rapidio/rio-scan.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.14","versionType":"semver"},{"version":"5.10.270","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.221","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.188","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.52","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/rapidio/rio-scan.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/24f60ebabeb8757cec8ec2f97660d521bc9147ec"},{"url":"https://git.kernel.org/stable/c/6a760a53e73064735cdfa9e51c664983a89baf96"},{"url":"https://git.kernel.org/stable/c/3f00999e44d9984036a029dbad9d2afe94a674d0"},{"url":"https://git.kernel.org/stable/c/332591a245de978349a7558f8b20469951bb77cc"},{"url":"https://git.kernel.org/stable/c/75f0bc167b96bbbef8182b88308c732af82c8d83"},{"url":"https://git.kernel.org/stable/c/44a37264b26911e13d0a4f5630751c4157ed0354"},{"url":"https://git.kernel.org/stable/c/530a9d5ef831a0049dad9a6b2b92d02301352c38"},{"url":"https://git.kernel.org/stable/c/b74030fbf187b43c1f85b66a7082e9946511cb5d"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T09:01:35.572Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.235","versionEndExcluding":"5.10.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.179","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.131","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.83","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.19","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.291"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13.7"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}