CVE-2026-93054 uio: Fix stale info pointer in failed registration path
A race condition in the Linux kernel UIO driver allows attackers to trigger a use-after-free, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93054?
CVE-2026-93054 is a high-severity use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
uio: Fix stale info pointer in failed registration path
After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info.
That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev->info and dereference freed memory.
Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uio_unregister_device().
Which versions are affected by CVE-2026-93054?
How do I fix CVE-2026-93054?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-93054 being exploited?
There is no known exploitation of CVE-2026-93054 in the wild and no public exploit code.
Sources
Also known as AZL-102587, BELL-CVE-2026-93054, DEBIAN-CVE-2026-93054, GHSA-v69r-w76r-qv39, UBUNTU-CVE-2026-93054.