CVE-2026-63907

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63907", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.020Z", "datePublished": "2026-07-19T14:55:13.652Z", "dateUpdated": "2026-07-19T14:55:13.652Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T14:55:13.652Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory\n\nuio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in\nprobe(), but then calls kfree(udev) both on the probe() error path\n(label out_free) and again in remove().\n\nBecause devm_kzalloc() allocations are devres-managed and are freed\nautomatically when the device is detached (including after a failing\nprobe() and during driver unbind), the explicit kfree() can lead to a\ndouble free.\n\nIf probe() fails after devm_kzalloc(), the error path frees udev and\ndevres cleanup will free it again when the core unwinds the partially\nbound device. On normal driver removal, remove() frees udev and devres\nwill free it again when the device is detached.\n\nThis issue was identified by a static analysis tool I developed and\nconfirmed by manual review. Fix by removing the manual kfree() calls\nand dropping the now-unused label."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/uio/uio_pci_generic_sva.c"], "versions": [{"version": "3397c3cd859a2c51962ad032dcf97961d42f9db2", "lessThan": "e344865bfca4eb37ed8d7ac5917226e49fcec7ce", "status": "affected", "versionType": "git"}, {"version": "3397c3cd859a2c51962ad032dcf97961d42f9db2", "lessThan": "f74c8696f14149d5e43cc28b015326a759c48f00", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/uio/uio_pci_generic_sva.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e344865bfca4eb37ed8d7ac5917226e49fcec7ce"}, {"url": "https://git.kernel.org/stable/c/f74c8696f14149d5e43cc28b015326a759c48f00"}], "title": "uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/uio/uio_pci_generic_sva.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e344865bfca4eb37ed8d7ac5917226e49fcec7ce", "status": "affected", "version": "3397c3cd859a2c51962ad032dcf97961d42f9db2", "versionType": "git"}, {"lessThan": "f74c8696f14149d5e43cc28b015326a759c48f00", "status": "affected", "version": "3397c3cd859a2c51962ad032dcf97961d42f9db2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/uio/uio_pci_generic_sva.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory\n\nuio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in\nprobe(), but then calls kfree(udev) both on the probe() error path\n(label out_free) and again in remove().\n\nBecause devm_kzalloc() allocations are devres-managed and are freed\nautomatically when the device is detached (including after a failing\nprobe() and during driver unbind), the explicit kfree() can lead to a\ndouble free.\n\nIf probe() fails after devm_kzalloc(), the error path frees udev and\ndevres cleanup will free it again when the core unwinds the partially\nbound device. On normal driver removal, remove() frees udev and devres\nwill free it again when the device is detached.\n\nThis issue was identified by a static analysis tool I developed and\nconfirmed by manual review. Fix by removing the manual kfree() calls\nand dropping the now-unused label."}], "id": "CVE-2026-63907", "lastModified": "2026-10-30T14:30:10.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-19T16:17:08.517", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e344865bfca4eb37ed8d7ac5917226e49fcec7ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f74c8696f14149d5e43cc28b015326a759c48f00"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory", "id": "2502468", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502468"}, "csaw": false, "cwe": "CWE-1341", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nuio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory\nuio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in\nprobe(), but then calls kfree(udev) both on the probe() error path\n(label out_free) and again in remove().\nBecause devm_kzalloc() allocations are devres-managed and are freed\nautomatically when the device is detached (including after a failing\nprobe() and during driver unbind), the explicit kfree() can lead to a\ndouble free.\nIf probe() fails after devm_kzalloc(), the error path frees udev and\ndevres cleanup will free it again when the core unwinds the partially\nbound device. On normal driver removal, remove() frees udev and devres\nwill free it again when the device is detached.\nThis issue was identified by a static analysis tool I developed and\nconfirmed by manual review. Fix by removing the manual kfree() calls\nand dropping the now-unused label.", "A flaw was found in the `uio_pci_generic_sva` module of the Linux kernel. This vulnerability, a double free, occurs because memory allocated with `devm_kzalloc()` is automatically freed, but the `kfree(udev)` function is also explicitly called during both error handling and device removal. A local attacker could exploit this double free to cause memory corruption, potentially leading to a denial of service (DoS) on the system."], "name": "CVE-2026-63907", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63907\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63907\nhttps://lore.kernel.org/linux-cve-announce/2026071945-CVE-2026-63907-709c@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3397c3cd859a2c51962ad032dcf97961d42f9db2,e344865bfca4eb37ed8d7ac5917226e49fcec7ce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3397c3cd859a2c51962ad032dcf97961d42f9db2,f74c8696f14149d5e43cc28b015326a759c48f00)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T14:45:02.196173+00:00", "updated": "2026-10-30T17:15:14.910141+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}