Executive brief
The Linux kernel's PCI endpoint test driver had a race condition where interrupt handlers could be invoked after the device's memory was freed during removal. An attacker with local access or ability to trigger device removal could exploit this to cause a kernel crash (denial of service) or potentially achieve code execution through memory corruption.
Technical details
A use-after-free vulnerability exists in the pci_endpoint_test_remove() function where IRQs were freed after the device's memory-mapped I/O regions were unmapped and released. This creates a race window where incoming interrupts can trigger the IRQ handler to access already-freed memory, causing an oops or kernel panic. The vulnerability affects the ordering of cleanup operations: IRQs must be disabled before releasing device resources. The fix reorders the cleanup to call pci_endpoint_test_release_irq() and pci_endpoint_test_free_irq_vectors() before misc_deregister() and pci_iounmap(), eliminating the race condition. Patches are available in the Linux stable tree across multiple kernel versions.
Affected products
- Linux Linux Multiple versions (e.g., 5.x, 6.x series)
Timeline
- 2023-04-15: disclosed: Upstream commit date
- 2023-07-23: patched: Merged into stable trees
- 2025-12-30: advisory: Published in NVD as CVE-2023-54326