Executive brief
The Linux kernel's Xen grant device (gntdev) driver contains a resource management bug in its ioctl handler that can cause memory leaks and kernel data structure corruption. When copying operation results to userspace fails after successfully mapping memory, the mapping remains improperly tracked with leaked references, potentially causing kernel memory exhaustion or stability issues on systems using Xen virtualization.
Technical details
The vulnerability is a resource cleanup bug in the gntdev_ioctl_map_grant_ref() function (drivers/xen/gntdev.c). When copy_to_user() fails after gntdev_add_map() successfully adds a mapping to the driver's internal list, the error path returns -EFAULT without releasing the reference acquired by gntdev_alloc_map() or removing the mapping from the list. Additionally, the index value is retrieved before gntdev_add_map() completes, but that function may modify map->index to avoid overlaps, causing the wrong index to be returned to userspace. The fix holds the mutex across map addition and copy_to_user(), and on copy failure, removes the mapping from the list and releases the reference while holding the lock. The attack vector is local through ioctl, and successful exploitation by a privileged user triggers memory leaks and kernel data corruption.
Affected products
- Linux Linux kernel multiple versions (fix backported across stable branches)
Timeline
- 2026-08-15: disclosed
- 2026-06-22: patched: Fix committed upstream