CVE-2026-89742

In the Linux kernel, the following vulnerability has been resolved:

rapidio: mport cdev: fix use-after-free in dma req free()

dma req free() acquires buf mutex through req->map, drops the mapping reference with kref put(), and then dereferences req->map again to unlock the mutex.

If kref put() drops the last reference, mport release mapping() frees the mapping, and the subsequent mutex unlock() dereferences a freed object. This is a use-after-free.

Fix this by caching map and md before kref put(), clearing req->map while holding buf mutex, and using the cached md for mutex unlocking.

The bug is reachable from userspace via the RapidIO mport character device interface.