The Linux kernel contained a use-after-free vulnerability in the RapidIO mport character device interface. Specifically, dma_req_free() acquires a mutex via req->map, then calls kref_put() which may free the mapping if the last reference is dropped. After freeing, the code attempts to unlock the mutex by dereferencing req->map again, which is now a freed object. The fix involves caching the mapping and metadata before calling kref_put(), clearing req->map while holding the mutex, and using the cached metadata to safely unlock the mutex, preventing dereferencing a freed object.

This vulnerability could lead to kernel memory corruption due to use-after-free, potentially causing system instability or crashes. Since it is reachable from userspace via the RapidIO mport character device interface, a local user with access to this interface could trigger the flaw. No information about active exploitation or remote exploitation is provided.

A fix has been implemented in the Linux kernel to address this vulnerability. Users should apply the official kernel updates that include this patch. Since no explicit patch links or vendor advisories are provided here, users should monitor Linux kernel release notes and update to the fixed kernel version once available.