Use-after-free in Linux kernel - CVE-2026-89764

Vulnerability details

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a race condition in the Rust Devres resource-management component when concurrently revoking a Devres object. A local user can trigger concurrent resource revocation to cause a use-after-free condition.

The condition occurs when the release callback and Devres destruction execute concurrently.

Affected software

How to mitigate CVE-2026-89764

External References

• https://git.kernel.org/stable/c/acc516dfa1972d31836b50abc0115216cd0fccc5
• https://git.kernel.org/stable/c/c7e3d57c705ab1053a6a1bbef96795e792da1540

Related Security Bulletins

• Use-after-free in Linux kernel Rust Devres resource-management component (rust/kernel/devres.rs)