Executive brief
A race condition was identified in the Linux kernel's VFIO PCI driver, which manages how hardware devices are assigned to virtual machines. During device shutdown, a small timing window allowed hardware resources to be accessed after they were supposed to be disabled. This could potentially lead to system instability or unauthorized access to hardware memory regions as they are being reassigned to other drivers.
Technical details
A race condition exists in `drivers/vfio/pci/vfio_pci_core.c` within the `vfio_pci_core_close_device()` function. The root cause was an incorrect teardown sequence where `vfio_pci_core_disable()` was called before `vfio_pci_dma_buf_cleanup()`. This created a window where the PCI function's Memory Space Enable (MSE) was cleared, yet Base Address Registers (BARs) could still be accessed via exported DMABUFs. An attacker with local access to manage VFIO devices could potentially exploit this timing window to access memory regions as they are being freed or reassigned. The fix reorders the cleanup sequence to revoke DMABUF access before disabling the PCI function.
Affected products
- Linux Linux Kernel 6.19 to 7.0.10
Timeline
- 2026-04-15: other: Patch submitted by developer
- 2026-05-23: patched: Patch committed to stable tree
- 2026-06-26: disclosed: CVE published