{"id":"CVE-2026-93054","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-93054","summary":"uio: Fix stale info pointer in failed registration path","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nuio: Fix stale info pointer in failed registration path\n\nAfter device_add(), the UIO device is visible to userspace and /dev/uioX\ncan be opened. If a later setup step fails, __uio_register_device()\nunwinds the device but leaves idev->info pointing at the caller-owned\nstruct uio_info.\n\nThat is unsafe when an opener races with the failed registration path.\nThe open file keeps a reference to the uio_device, while the caller sees\nregistration failure and may free its struct uio_info. Later file\noperations can then follow idev->info and dereference freed memory.\n\nHandle post-device_add() failures like unregister: remove UIO attributes\nwhile the info pointer is still valid, then clear idev->info under\ninfo_lock and wake existing waiters/async users before removing the\ndevice and minor. This makes already-open file descriptors observe the\nsame \"device gone\" state as normal uio_unregister_device().","published":"2026-09-17T16:10:43.104Z","modified":"2026-09-19T03:47:31.068788258Z","cvss":{"score":7,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"5.10.270"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/15340b00e665af805523b08515294a1aa1778151"},{"type":"WEB","url":"https://git.kernel.org/stable/c/16695e9059d80ea6661e8399064b0c01f641dd8c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac"},{"type":"WEB","url":"https://git.kernel.org/stable/c/506b43dde5f9ac0068b1360e6b5dbee07fda59fb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/63eaa7663335d482a8825c231213e312cacea567"},{"type":"WEB","url":"https://git.kernel.org/stable/c/67b6fc084b034a91c3ec7907a3fed89a2450f30b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/df4faf65194ec6c315a59be4c6749eaeb3009243"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ec5bd6731183eb6f619140c9bef2ee11ed818c20"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93054.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93054"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-19T03:47:31.068788258Z"}}