Executive brief
The Linux kernel's UIO (Userspace I/O) subsystem had a race condition during device registration failures that could allow processes with open file handles to access freed memory. When device registration fails after the device becomes visible to userspace, a caller-owned data structure could be freed while an open file descriptor still holds a reference to the device, leading to potential information disclosure or system instability.
Technical details
This is a use-after-free vulnerability in the UIO device registration path. The vulnerability occurs when __uio_register_device() fails after device_add(), which makes the device visible to userspace. If an opener races with the failed registration path, the open file keeps a reference to the uio_device while the caller sees registration failure and frees its uio_info structure. Subsequent file operations dereference the now-freed idev->info pointer, causing a use-after-free. The fix clears the info pointer under proper locking (info_lock) and wakes existing waiters/async users before device removal, ensuring already-open file descriptors observe a "device gone" state. This requires local access to open the /dev/uioX device but no special privileges.
Affected products
- Linux Linux kernel all versions prior to patch (2026-09-14)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched