CVE-2026-89764

In the Linux kernel, the following vulnerability has been resolved:

rust: devres: fix race between concurrent revokers

There is a potential race condition when two paths try to revoke a Devres concurrently.

The driver core's devres release all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke nosync() on another CPU.

The revoker that does not claim the is available swap returns immediately, but the revoker that did may still be executing drop in place() on the inner data. This can cause a use-after-free when the other revoker's caller proceeds to drop adjacent resources that drop in place() still references (e.g., Devres racing with SGTable freeing the backing sg table and pages).

Fix this by adding a Completion. The release callback signals the Completion after revoke() finishes, and Devres::drop() waits for it when it loses the is available swap. This ensures the wrapped object is fully torn down before Devres::drop() returns.