CVE-2026-93054

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

uio: Fix stale info pointer in failed registration path

After device_add(), the UIO device is visible to userspace and /dev/uioX

can be opened. If a later setup step fails, __uio_register_device()

unwinds the device but leaves idev->info pointing at the caller-owned

struct uio_info.

That is unsafe when an opener races with the failed registration path.

The open file keeps a reference to the uio_device, while the caller sees

registration failure and may free its struct uio_info. Later file

operations can then follow idev->info and dereference freed memory.

Handle post-device_add() failures like unregister: remove UIO attributes

while the info pointer is still valid, then clear idev->info under

info_lock and wake existing waiters/async users before removing the

device and minor. This makes already-open file descriptors observe the

same "device gone" state as normal uio_unregister_device().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References