CVE-2026-93054

A flaw was found in the Linux kernel. When a User-space I/O (UIO) device fails to register, a pointer to memory that has already been released can remain active. A local user could exploit a race condition during this process. This could lead to the system attempting to access freed memory, potentially causing a system crash or denial of service.

A race in the UIO failed registration path can leave idev info pointing to caller owned struct uio_info after /dev/uioX has already become visible to userspace. If a local process opens the device during this narrow window and registration later fails, the caller may free struct uio_info while the open file still holds a reference to the uio_device. Later file operations can dereference the stale idev info pointer, creating a use-after-free condition. For the CVSS the PR:L is used because a local user or process must be able to open /dev/uioX during the failed registration window. The issue is not network reachable. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to use-after-free of driver controlled state and callbacks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.