Executive brief
The Intel Adaptive Virtual Function (iavf) network driver for Linux has a memory management bug that can cause system crashes or unexpected behavior. When the driver manages network queue vectors during SR-IOV virtual function creation and channel reconfiguration, it may free memory while still holding references to it, leading to potential system instability or denial of service.
Technical details
The vulnerability is a use-after-free bug in the iavf driver's free_netdev path. The driver calls netif_napi_add() to register all queue vector structures (q_vectors[]) with the network stack, but during cleanup it only partially deregisters them with netif_napi_del() before freeing the q_vectors array. This leaves dangling pointers in the kernel's dev->napi_list, which are later dereferenced, causing a KASAN (Kernel Address Sanitizer) use-after-free error. The vulnerability is triggered by concurrent SR-IOV virtual function creation/destruction and network channel reconfiguration operations. An attacker with the ability to manage SR-IOV VFs or modify network device settings could trigger this bug, resulting in kernel crash or potential code execution. Patches addressing the proper cleanup sequence are available in newer kernel versions.
Affected products
- Linux Linux Kernel Versions prior to fix (approximately 4.18 era and later with iavf driver)
Timeline
- 2025-10-04: disclosed