CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's RapidIO mport character device interface, specifically through a use-after-free condition in the dma_req_free() function. This flaw can lead to potential memory corruption, allowing attackers to exploit the vulnerability from userspace, which may result in system instability or arbitrary code execution. Organizations using Linux systems with RapidIO support should prioritize addressing this issue to mitigate risks associated with this vulnerability.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: rapidio: mport_cdev: fix use-after-free in dma_req_free() dma_req_free() acquires buf_mutex through req->map, drops the mapping reference with kref_put(), and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, mport_release_mapping() frees the mapping, and the subsequent mutex_unlock() dereferences a freed object. This is a use-after-free. Fix this by caching map and md before kref_put(), clearing req->map while holding buf_mutex, and using the cached md for mutex unlocking. The bug is reachable from userspace via the RapidIO mport character device interface.