Skip to main content

Linux Kernel EUVDEUVD-2026-38935

| CVE-2026-53067 HIGH
Double Free (CWE-415)
2026-06-24 Linux GHSA-6325-fcfv-pxv6
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only kernel double-free reachable by a privileged local user via the endpoint configfs path (AV:L, PR:L); memory corruption yields high C/I/A with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 21, 2026 - 20:01 vuln.today
CVSS changed
Jul 21, 2026 - 17:52 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc

pci_epf_alloc_doorbell() stores the allocated doorbell message array in epf->db_msg/epf->num_db before requesting MSI vectors. If MSI allocation fails, the array is freed but the EPF state may still point to freed memory.

Clear epf->db_msg and epf->num_db on the MSI allocation failure path so that later cleanup cannot double-free the array and callers can retry allocation.

Also return -EBUSY when doorbells have already been allocated to prevent leaking or overwriting an existing allocation.

AnalysisAI

Local privilege escalation and denial of service in the Linux kernel's PCI endpoint MSI framework (pci-ep-msi) arises from a double-free of the doorbell message array (epf->db_msg) when MSI vector allocation fails after the array has already been recorded in the endpoint function state. On the failure path the freed array is not cleared from epf->db_msg/epf->num_db, so subsequent cleanup or retry re-frees the same allocation (CWE-415). Exploitation is local with low privileges (CVSS 7.8); there is no public exploit identified at time of analysis and EPSS risk is low (0.15%, 5th percentile), consistent with a niche subsystem.

Technical ContextAI

The affected code is the PCI endpoint (EP) subsystem's MSI helper, drivers/pci/endpoint/pci-ep-msi.c, used when a Linux system operates as a PCI endpoint/function (common in embedded SoCs and device-side PCIe roles) rather than as a host/root complex. pci_epf_alloc_doorbell() allocates a doorbell message array and stores its pointer and count into the endpoint function object (epf->db_msg, epf->num_db) before requesting MSI interrupt vectors. When pci_epf_alloc_doorbell()'s MSI request fails, the array is freed but the stale pointer remains in the EPF state, leaving a dangling reference. The root cause class is CWE-415 (Double Free): a later cleanup path or a caller retry frees the same memory a second time, which can corrupt the kernel slab allocator. The fix clears epf->db_msg and epf->num_db on the failure path and returns -EBUSY when doorbells are already allocated to prevent re-allocation from leaking or overwriting the existing buffer. CPE data identifies the product only generically as cpe:2.3:a:linux:linux, so the affected component is the mainline kernel EP framework.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 7.1, 7.0.10, or 6.18.33 (or later) - or apply the upstream fix commits 175717cfc06cab79f84cd037d66dda1b8564cd9e / 3c25587fbf8797b92090b064a6d239a873e55fb1 / 1cba96c0a795124c3229293ed7b5b5765e66f259 from git.kernel.org/stable. Distribution users should install the packaged kernel updates referenced in Ubuntu USN-8568-1 and USN-8566-1 and reboot. Where immediate patching is not possible, the most effective compensating control is to avoid the vulnerable code path: on systems that do not need PCI endpoint functionality, build or boot without the PCI endpoint framework (CONFIG_PCI_ENDPOINT) so the driver is not loaded - trade-off: this disables device/endpoint-mode PCIe entirely and is only viable on hosts that operate purely as PCI root complexes. On devices that must run in endpoint mode, restrict access to the endpoint configfs interface (/sys/kernel/config/pci_ep) to trusted administrators only, since triggering the doorbell allocation/failure path requires interacting with that interface - trade-off: does not eliminate the bug, only limits who can reach it. Do not invent a specific fix version beyond those listed above.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38935 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy