{"id":"CVE-2026-89764","revision":"1250bba4361240cf882f0922c1d5144a","records":[{"revision":"1250bba4361240cf882f0922c1d5144a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89764","aliases":[],"title":"rust: devres: fix race between concurrent revokers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust: devres: fix race between concurrent revokers\n\nThere is a potential race condition when two paths try to revoke a\nDevres concurrently.\n\nThe driver core's devres_release_all() calls Revocable::revoke() via the\nrelease callback, while Devres::drop() calls revoke_nosync() on another\nCPU.\n\nThe revoker that does not claim the is_available swap returns\nimmediately, but the revoker that did may still be executing\ndrop_in_place() on the inner data. This can cause a use-after-free when\nthe other revoker's caller proceeds to drop adjacent resources that\ndrop_in_place() still references (e.g., Devres<DmaMappedSgt> racing with\nSGTable freeing the backing sg_table and pages).\n\nFix this by adding a Completion. The release callback signals the\nCompletion after revoke() finishes, and Devres::drop() waits for it when\nit loses the is_available swap. This ensures the wrapped object is fully\ntorn down before Devres::drop() returns.","state":0,"publishedAt":"2026-09-11T19:47:05.092+00:00","modifiedAt":"2026-10-19T08:52:17.882+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"rust/kernel/devres.rs\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"05aa6fb1c21d7fb9df735da24096d793223789d5\",\n                            \"lessThan\": \"e7930d857cc7930fc39b487ea9f3a453eca3713e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"05aa6fb1c21d7fb9df735da24096d793223789d5\",\n                            \"lessThan\": \"c7e3d57c705ab1053a6a1bbef96795e792da1540\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"05aa6fb1c21d7fb9df735da24096d793223789d5\",\n                            \"lessThan\": \"acc516dfa1972d31836b50abc0115216cd0fccc5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"rust/kernel/devres.rs\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.56\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/e7930d857cc7930fc39b487ea9f3a453eca3713e","https://git.kernel.org/stable/c/c7e3d57c705ab1053a6a1bbef96795e792da1540","https://git.kernel.org/stable/c/acc516dfa1972d31836b50abc0115216cd0fccc5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89764","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89764","identifiers":["CVE-2026-89764"]},"retained":false,"historicalAffected":[]}],"coverage":[]}