CVE-2026-90319

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rapidio: clear mport->net when rio_add_net() fails

rio_alloc_net() stores the newly allocated rio_net in mport->net before

rio_scan_alloc_net() registers the device.

If rio_add_net() fails, rio_scan_alloc_net() drops the device reference

with put_device(), which releases the rio_net through the device release

callback. However, mport->net is left pointing at the freed object.

A later mport unregister path can then dereference the dangling mport->net

pointer and may try to free the same rio_net again.

Clear mport->net in the rio_add_net() failure path, matching the cleanup

done for the destID table allocation failure path.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References