CVE-2026-89777

vfio/pci: clear vdev->msi_perm after freeing it on init failure

Published Sep 16, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: clear vdev->msi_perm after freeing it on init failure

vfio_msi_cap_len() lazily allocates the per-device MSI permission table:

vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);
if (!vdev->msi_perm)
return -ENOMEM;

ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
if (ret) {
kfree(vdev->msi_perm);
return ret; /* vdev->msi_perm left dangling */
}

When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the
error path frees vdev->msi_perm but leaves the freed pointer stored in
it. vdev->msi_perm is not re-zeroed later because struct
vfio_pci_core_device is per-device and persists across open/close cycles,
and the vfio_config_init() error path returns without calling
vfio_config_free(). So the dangling pointer outlives the failed open.

That leads to two use-after-frees on the same device:

1. Reuse. The next vfio_config_init() sees the stale pointer at
"if (vdev->msi_perm) return len;" and reuses the freed object. MSI
config accesses in vfio_pci_config_rw_single() then dereference and
call the freed perm->readfn / perm->writefn function pointers.

2. Double free. A later vfio_config_free() runs free_perm_bits() and
kfree() on the already-freed object.

Fix it by NULLing vdev->msi_perm after the kfree(), matching the
NULL-after-free discipline already used in free_perm_bits() and
vfio_config_free().

BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
Read of size 8 at addr ffff88800fcc88d0 by task exploit/143
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)
vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)
vfs_read (fs/read_write.c:572)
__x64_sys_pread64 (fs/read_write.c:764)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...

Followed on device close by a double free of the same object:

Oops: general protection fault, probably for non-canonical address
0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:kfree (mm/slub.c:6711)
Call Trace:
vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)
vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)
vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)
vfio_df_close (drivers/vfio/vfio_main.c:602)
vfio_device_fops_release (drivers/vfio/vfio_main.c:648)
__fput (fs/file_table.c:512)
__x64_sys_close (fs/open.c:1496)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Kernel panic - not syncing: Fatal exception

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< eb84cd81040e58dd05ac190f561f2115e3367249
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< f0eea8f9013676b42289ec35941e848b8a543e19
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< d665a1688af7f8fefd7c0eb04f2a37122ce007f4
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 25cdd2a492d868cff1e519a60fe282909c52d385
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 812f1db7f0755a19ef16ecdc5cec51bcabc5eda5
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 533d0c5feef85ee6404b9f41d5564fac6971a008
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< fda8fb7e8179561693a786a7af593f6b944a21c1
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< dc77acfeb979dded39b247b60fef0399536bfa77
`ac370e3d1f3b01519d2705cd5815d1c9d0a8812b`	affected	—
`be363e27ec3c3a99793da2be6c07eafb95709c6b`	affected	—
`f1b10ba5739440ca51d66f0b2949cead88d2dd02`	affected	—
`dde3433de9a067a33d67d65b9093cad3e043e49e`	affected	—
`4.4.203`	affected	< 4.5
`4.9.203`	affected	< 4.10
`4.14.155`	affected	< 4.15
`4.19.85`	affected	< 4.20

Linux

affected

Version	Status	Constraints
`4.20`	affected	—
`0`	unaffected	< 4.20
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,eb84cd81040e58dd05ac190f561f2115e3367249)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,f0eea8f9013676b42289ec35941e848b8a543e19)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,d665a1688af7f8fefd7c0eb04f2a37122ce007f4)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,25cdd2a492d868cff1e519a60fe282909c52d385)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,812f1db7f0755a19ef16ecdc5cec51bcabc5eda5)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,533d0c5feef85ee6404b9f41d5564fac6971a008)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,fda8fb7e8179561693a786a7af593f6b944a21c1)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,dc77acfeb979dded39b247b60fef0399536bfa77)`	affected	code_commit	—
`ac370e3d1f3b01519d2705cd5815d1c9d0a8812b`	affected	code_commit	—
`be363e27ec3c3a99793da2be6c07eafb95709c6b`	affected	code_commit	—
`f1b10ba5739440ca51d66f0b2949cead88d2dd02`	affected	code_commit	—
`dde3433de9a067a33d67d65b9093cad3e043e49e`	affected	code_commit	—
`[4.4.203,4.5)`	affected	semver	—
`[4.9.203,4.10)`	affected	semver	—
`[4.14.155,4.15)`	affected	semver	—
`[4.19.85,4.20)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.20`	affected	generic	—
`[0,4.20)`	unaffected	generic	—
`5.10.270<=5.10.*`	unaffected	generic	—
`5.15.221<=5.15.*`	unaffected	generic	—
`6.1.188<=6.1.*`	unaffected	generic	—
`6.6.157<=6.6.*`	unaffected	generic	—
`6.12.110<=6.12.*`	unaffected	generic	—
`6.18.52<=6.18.*`	unaffected	generic	—
`7.2.6<=7.2.*`	unaffected	generic	—
`7.3-rc1<=*`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.164% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385
https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008
https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5
https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4
https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77
https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249
https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19
https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1

History

Sep 20, 2026 5:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-415 CWE-416

Sep 18, 2026 11:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-415 CWE-416

Sep 16, 2026 3:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-415 CWE-416

Sep 16, 2026 2:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Sep 16, 2026 9:00 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open. That leads to two use-after-frees on the same device: 1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers. 2. Double free. A later vfio_config_free() runs free_perm_bits() and kfree() on the already-freed object. Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free(). BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Followed on device close by a double free of the same object: Oops: general protection fault, probably for non-canonical address 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI RIP: 0010:kfree (mm/slub.c:6711) Call Trace: vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861) vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685) vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777) vfio_df_close (drivers/vfio/vfio_main.c:602) vfio_device_fops_release (drivers/vfio/vfio_main.c:648) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1496) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Kernel panic - not syncing: Fatal exception
Title		vfio/pci: clear vdev->msi_perm after freeing it on init failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385 https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008 https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5 https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4 https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77 https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249 https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19 https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1