Linux Kernel EUVD-2026-39857

Requires local access to a system where the attacker can bind/use a VFIO PCI device and create DMABUF exports of its BARs - i.e. the host must have VFIO PCI passthrough enabled and grant the attacker (a local user, container, or guest) access to /dev/vfio device nodes; this is typical only on virtualization/passthrough hosts, not default desktop/server configs. Per the CVSS vector PR:L, some privilege/device access is needed (consistent with VFIO group permissions). The principal limiting factor is the timing: exploitation depends on winning a 'tiny window' race during device shutdown, so success is probabilistic and may require many attempts; it is not exploitable remotely and not against systems that do not expose VFIO passthrough.

Signals are mixed and lean toward low practical priority despite the 8.8 base score. The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a local, low-privilege, scope-changing flaw with full CIA impact, which is consistent with a process being able to corrupt resources later claimed by another driver. However, the AC:L rating is questionable: the description explicitly calls this a 'tiny window' race, which in practice is closer to AC:H - winning a narrow shutdown race is not trivially reliable. EPSS (0.14%) and percentile (4%) indicate very low expected exploitation, the CVE is not on CISA KEV, and no POC is referenced, so there is no confirmed active exploitation. SSVC inputs (exploitation status, automatable, technical impact) were not provided. Net: a legitimate local-privilege/host-integrity bug worth patching on systems that actually grant VFIO device access (virtualization hosts), but not an urgent internet-facing emergency. Note the vector says local access while the tag says Information Disclosure - the realistic impact is resource confusion/info leak plus potential integrity loss, more than remote compromise.

A local user (or a guest/userspace driver) that legitimately holds a VFIO PCI device repeatedly triggers device close/shutdown while holding or re-mapping DMABUF references to the device's BARs, racing to access the memory in the tiny window after the function is disabled and its resources are freed. Winning the race lets the attacker read or write resources that have been released and potentially reassigned to another driver, causing information disclosure or host-side resource corruption. No public POC is referenced, and reliable exploitation depends on hitting a narrow timing window.