A use-after-free vulnerability in the Linux kernel RapidIO interface presents a high-severity risk to system integrity and availability for users with local access.

This is a use-after-free vulnerability occurring within the dma_req_free function of the RapidIO mport character device driver. A local attacker with low privileges can trigger the flaw by interacting with the character device, leading to a dereference of freed memory during mutex operations.

The vulnerability carries a CVSS score of 7.8, indicating a high level of risk for systems utilizing the RapidIO interface. Successful exploitation could allow a local attacker to crash the system, cause kernel-level memory corruption, or potentially escalate privileges, resulting in unauthorized system access or complete loss of system availability.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults related to the RapidIO driver or character device interactions.

Compensating Controls: Restrict access to the RapidIO character device files (/dev/rio_mport) to only authorized users or processes to prevent untrusted local users from interacting with the vulnerable interface.

Public Exploit Available: No (exploit_available: false)

Given the potential for privilege escalation and system instability, organizations should prioritize patching affected Linux kernels. System administrators should verify their kernel version and apply the recommended security updates as part of their standard patch management cycle to eliminate this vulnerability.