EUVD-2026-80298
GHSA-552v-qphj-5fjg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local vfio device access (PR:L, AV:L); AC:H because the bug only triggers after forcing an -ENOMEM allocation failure; kernel UAF from a confined userspace context gives S:C and full C/I/A.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: clear vdev->msi_perm after freeing it on init failure
vfio_msi_cap_len() lazily allocates the per-device MSI permission table:
vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM;
ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ }
When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open.
That leads to two use-after-frees on the same device:
- Reuse. The next vfio_config_init() sees the stale pointer at
"if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers.
- Double free. A later vfio_config_free() runs free_perm_bits() and
kfree() on the already-freed object.
Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free().
BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ...
Followed on device close by a double free of the same object:
Oops: general protection fault, probably for non-canonical address 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI RIP: 0010:kfree (mm/slub.c:6711) Call Trace: vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861) vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685) vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777) vfio_df_close (drivers/vfio/vfio_main.c:602) vfio_device_fops_release (drivers/vfio/vfio_main.c:648) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1496) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Kernel panic - not syncing: Fatal exception
AnalysisAI
A memory-corruption flaw in the Linux kernel's vfio-pci driver (vfio/pci/vfio_pci_config.c) allows a local user holding access to a VFIO passthrough device node (typically /dev/vfio/*) to trigger a use-after-free and subsequent double-free of the per-device MSI permission table (vdev->msi_perm). Exploitation requires attacker-induced failure of the allocation path (init_pci_cap_msi_perm()/alloc_perm_bits() returning -ENOMEM during a failed device open, e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a VFIO passthrough device node (typically /dev/vfio/*), i.e., a user or process granted PCI passthrough rights for VMs or userspace drivers - this is not present on default general-purpose systems. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine kernel memory-corruption bug (use-after-free plus double-free of vdev->msi_perm in the vfio-pci config path), not a paper-tiger high-CVSS issue, but its real-world priority is moderated by access prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released kernel patches: upgrade to Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 or 7.3-rc1 (or newer) as appropriate for your branch; the individual stable fixes are published at https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249, https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19, https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4, https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385, https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5, https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008, https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1 and https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77, with the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-89777. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Linux host where VFIO/PCI passthrough is enabled (KVM/QEMU virtualization clusters, GPU and accelerator passthrough nodes, private-cloud tenants) and confirm that access to /dev/vfio/* device nodes is restricted to the minimum set of privileged users and virtualization services, tightening ownership and permissions where it is broader than required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today