CVE-2026-93054

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-93054

Key Details

CVE	CVE-2026-93054
CVSS Score / Version	7.0 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is high; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

uio: Fix stale info pointer in failed registration path

After device_add(), the UIO device is visible to userspace and /dev/uioX

can be opened. If a later setup step fails, __uio_register_device()

unwinds the device but leaves idev->info pointing at the caller-owned

struct uio_info.

That is unsafe when an opener races with the failed registration path.

The open file keeps a reference to the uio_device, while the caller sees

registration failure and may free its struct uio_info. Later file

operations can then follow idev->info and dereference freed memory.

Handle post-device_add() failures like unregister: remove UIO attributes

while the info pointer is still valid, then clear idev->info under

info_lock and wake existing waiters/async users before removing the

device and minor. This makes already-open file descriptors observe the

same "device gone" state as normal uio_unregister_device(). (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-93054
CVE	https://www.cve.org/CVERecord?id=CVE-2026-93054

Source

Reference

NVD

CVE