https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:54:58 +0000 https://vulnerability.circl.lu/vuln/cve-2026-93054 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>uio: Fix stale info pointer in failed registration path</p> <p>After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev-&gt;info pointing at the caller-owned struct uio_info.</p> <p>That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev-&gt;info and dereference freed memory.</p> <p>Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev-&gt;info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same &#34;device gone&#34; state as normal uio_unregister_device().</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>uio: Fix stale info pointer in failed registration path</p> <p>After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev-&gt;info pointing at the caller-owned struct uio_info.</p> <p>That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev-&gt;info and dereference freed memory.</p> <p>Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev-&gt;info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same &#34;device gone&#34; state as normal uio_unregister_device().</p> https://vulnerability.circl.lu/vuln/cve-2026-93054