CVE-2026-89764 rust: devres: fix race between concurrent revokers
A race condition in the Linux kernel's Rust devres implementation allows use-after-free, potentially enabling code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89764?
CVE-2026-89764 is a high-severity vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rust: devres: fix race between concurrent revokers
There is a potential race condition when two paths try to revoke a Devres concurrently.
The driver core's devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU.
The revoker that does not claim the is_available swap returns immediately, but the revoker that did may still be executing drop_in_place() on the inner data. This can cause a use-after-free when the other revoker's caller proceeds to drop adjacent resources that drop_in_place() still references (e.g., Devres<DmaMappedSgt> racing with SGTable freeing the backing sg_table and pages).
Fix this by adding a Completion. The release callback signals the Completion after revoke() finishes, and Devres::drop() waits for it when it loses the is_available swap. This ensures the wrapped object is fully torn down before Devres::drop() returns.
Which versions are affected by CVE-2026-89764?
How do I fix CVE-2026-89764?
Apply the vendor's patch.
Is CVE-2026-89764 being exploited?
There is no known exploitation of CVE-2026-89764 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89764, DEBIAN-CVE-2026-89764, GHSA-8vmv-qf47-5pwf, UBUNTU-CVE-2026-89764.