Linux Kernel EUVD-2026-80298

Requires local access to a VFIO passthrough device node (typically /dev/vfio/*), i.e., a user or process granted PCI passthrough rights for VMs or userspace drivers - this is not present on default general-purpose systems. Exploitation further requires triggering the -ENOMEM error path in alloc_perm_bits()/init_pci_cap_msi_perm() during a failed device open (inducing a kernel allocation failure via memory pressure or fault injection), then re-opening the same persistent vfio_pci_core_device to hit the reuse UAF, or closing it to hit the double free. Limiting factors: no remote vector, requires the vfio-pci driver in use, requires device-open privileges, and requires the attacker to force an allocation failure - a non-trivial precondition that reduces reliability.

This is a genuine kernel memory-corruption bug (use-after-free plus double-free of vdev->msi_perm in the vfio-pci config path), not a paper-tiger high-CVSS issue, but its real-world priority is moderated by access prerequisites. The vendor CVSS of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) correctly captures a local, low-privilege attacker achieving full C/I/A impact with scope change - plausible because a UAF that dereferences freed perm->readfn/writefn function pointers can be steered toward arbitrary kernel code execution / privilege escalation. However, exploitation is not as easy as AC:L implies: the freed-then-reused state is only reached after init_pci_cap_msi_perm()->alloc_perm_bits() returns -ENOMEM, so an attacker must reliably induce a kernel allocation failure (memory pressure or fault injection) during device open - a real barrier that argues for AC:H. EPSS is low (0.21%, 11th percentile), there is no CISA KEV entry and no public exploit, so this is a patch-in-normal-cycle item rather than an emergency. Note also a data conflict: the input Tags label this 'Information Disclosure,' which contradicts the C:H/I:H/A:H memory-corruption nature of a UAF/double-free - treat the tag as wrong, not the vector. CWE is 'N/A' in the input but the description is unambiguously a use-after-free (CWE-416).

A local user who has been granted access to a VFIO device (e.g., a VM/userspace-driver operator with rights to /dev/vfio) opens a passthrough PCI device while inducing memory pressure so that MSI permission-table initialization fails with -ENOMEM, leaving a dangling freed vdev->msi_perm. On a subsequent open the stale pointer is reused and MSI config reads dereference freed function pointers, and on device close the same object is freed again. No public exploit code exists, but the KASAN reproducer in the report shows the crash is directly reachable via a pread on the device fd.