Executive brief
A vulnerability in the Linux kernel's VFIO component, which manages hardware access for virtual machines, can cause the system to freeze or crash. This occurs during specific device migration tasks where the system enters an infinite loop while holding a critical lock. An exploit could lead to a complete denial of service, impacting the availability of the host system and all hosted virtual machines.
Technical details
A vulnerability exists in the vfio_mig_get_next_state() function within the Linux kernel's VFIO driver. The function iterates through a finite state machine (FSM) table to determine the next migration state, skipping optional unsupported states. However, the loop fails to account for the 'VFIO_DEVICE_STATE_ERROR' sentinel value used for blocked transitions. When a blocked transition (such as STOP_COPY to PRE_COPY) is encountered, the loop condition remains true indefinitely while holding the driver state mutex. This results in a soft lockup and potential kernel panic if 'softlockup_panic' is enabled. The issue has been resolved by adding a check to terminate the loop if the error sentinel is reached.
Affected products
- Linux Linux Kernel 6.2 to 6.6.145, 6.12.96, 6.18.39, 7.1.4
Timeline
- 2026-06-02: other: Vulnerability fixed in upstream kernel code
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/7f2d6b31089e48db4653df832c9a6afdde9a1c29
- https://git.kernel.org/stable/c/8e872c07e40d51a66dee7b280a23a460a2e1e3fa
- https://git.kernel.org/stable/c/a26b499b757cfc8bbff1088bb1b844639e250893
- https://git.kernel.org/stable/c/a3a8afa2f6e7f0dc266d08f02be3f3054241ba47
- https://git.kernel.org/stable/c/ed7d5599e6c398da74845767cd1e6a8370a160fc