Answer in brief
CVE-2026-93054 records a High severity (CVSS 7.0) vulnerability in uio: Fix stale info pointer in failed registration path. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a93e7b331568227500186a465fee3c2cb5dffd1f <63eaa7663335d482a8825c231213e312cacea567 || >=a93e7b331568227500186a465fee3c2cb5dffd1f <df4faf65194ec6c315a59be4c6749eaeb3009243 || >=a93e7b331568227500186a465fee3c2cb5dffd1f <506b43dde5f9ac0068b1360e6b5dbee07fda59fb || >=a93e7b331568227500186a465fee3c2cb5dffd1f <15340b00e665af805523b08515294a1aa1778151 || >=a93e7b331568227500186a465fee3c2cb5dffd1f <234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac || >=a93e7b331568227500186a465fee3c2cb5dffd1f <16695e9059d80ea6661e8399064b0c01f641dd8c || >=a93e7b331568227500186a465fee3c2cb5dffd1f <ec5bd6731183eb6f619140c9bef2ee11ed818c20 || >=a93e7b331568227500186a465fee3c2cb5dffd1f <67b6fc084b034a91c3ec7907a3fed89a2450f30b || 085d735c858934e5d5bfaedb1fc98bd9135e6ff1 || >=4.14.100 <4.15 | 63eaa7663335d482a8825c231213e312cacea567, df4faf65194ec6c315a59be4c6749eaeb3009243, 506b43dde5f9ac0068b1360e6b5dbee07fda59fb, 15340b00e665af805523b08515294a1aa1778151, 234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac, 16695e9059d80ea6661e8399064b0c01f641dd8c, ec5bd6731183eb6f619140c9bef2ee11ed818c20, 67b6fc084b034a91c3ec7907a3fed89a2450f30b, 4.15 |
| Linux/Linuxgeneric | 4.18 | Not reported |
Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 17, 2026
In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info. That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev->info and dereference freed memory. Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uio_unregister_device().
Quoted source text, attributed separately from HOL analysis.