Executive brief
A vulnerability was identified in the Linux kernel's UIO PCI driver that could cause a system crash. The issue occurs when the system attempts to free the same memory twice during certain hardware initialization or removal processes. This could lead to system instability or a denial of service, affecting the reliability of servers or workstations using specific PCI hardware.
Technical details
A double-free vulnerability exists in drivers/uio/uio_pci_generic_sva.c within the Linux kernel. The driver allocates memory for the 'uio_pci_sva_dev' structure using devm_kzalloc(), which is a managed resource automatically freed by the kernel's devres framework. However, the driver also explicitly calls kfree() on this same memory in both the probe() error path and the remove() function. This results in the memory being freed twice: once manually and once automatically by the kernel when the device is detached or when a probe fails. An attacker with the ability to trigger driver probing or removal could potentially exploit this to cause a kernel panic. The issue has been resolved by removing the redundant kfree() calls.
Affected products
- Linux Linux Kernel 6.19 to 7.0.11
Timeline
- 2026-05-05: disclosed: Vulnerability identified and patch submitted by researcher
- 2026-06-09: patched: Patch committed to stable kernel tree
- 2026-07-19: advisory: CVE-2026-63907 published