SEPTEMBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-89764

HIGH · CVSS 7.8 EPSS 0.14%

Source: NVD + CISA KEV + EPSS · Published 2026-09-11 · Last synced 2026-09-13

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's handling of device resource management, specifically in the Rust implementation, where a race condition can occur between concurrent revocation processes. This may lead to a use-after-free scenario, potentially compromising system stability and security when adjacent resources are improperly accessed. Organizations utilizing Linux in critical environments should prioritize addressing this issue to mitigate risks associated with concurrent resource management.

CVE
CVE-2026-89764
Severity
HIGH
CVSS
7.8
EPSS
0.14%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU. The revoker that does not claim the is_available swap returns immediately, but the revoker that did may still be executing drop_in_place() on the inner data. This can cause a use-after-free when the other revoker's caller proceeds to drop adjacent resources that drop_in_place() still references (e.g., Devres<DmaMappedSgt> racing with SGTable freeing the backing sg_table and pages). Fix this by adding a Completion. The release callback signals the Completion after revoke() finishes, and Devres::drop() waits for it when it loses the is_available swap. This ensures the wrapped object is fully torn down before Devres::drop() returns.