Executive brief
A vulnerability in the Linux kernel's PCI endpoint subsystem could allow for a system crash or unpredictable behavior. The issue occurs when the system fails to properly clean up memory after a failed hardware communication setup (MSI allocation). This could lead to a 'double-free' scenario where the system attempts to release the same memory twice, potentially impacting system stability and availability.
Technical details
A vulnerability exists in drivers/pci/endpoint/pci-ep-msi.c within the pci_epf_alloc_doorbell() function. The function stores pointers to a doorbell message array in the EPF state before successfully requesting MSI vectors. If the MSI allocation fails, the array is freed, but the pointers in the EPF state are not cleared, leading to a potential double-free during subsequent cleanup or retry attempts. Additionally, the lack of a check for existing allocations could lead to memory leaks or overwriting active allocations. The fix involves clearing the state pointers on failure and returning -EBUSY if doorbells are already allocated.
Affected products
- Linux Linux 6.17 to 6.18.33, 7.0.10, 7.1
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory