Executive brief
The Linux kernel's VFIO (Virtual Function I/O) subsystem contains a use-after-free vulnerability in its handling of PCI device MSI (Message Signaled Interrupt) permission tables. When device initialization fails, a freed memory pointer is not properly cleared, allowing an attacker to trigger memory corruption through device file access. This can lead to reading sensitive kernel memory and causing system crashes.
Technical details
The vulnerability is a use-after-free bug in vfio_msi_cap_len() where vdev->msi_perm is freed on init failure but the pointer is not zeroed. This dangling pointer persists across open/close cycles because the vfio_pci_core_device structure remains allocated. An attacker can trigger two distinct exploits: (1) reuse of the freed pointer by the next vfio_config_init() call, leading to arbitrary function pointer dereference through perm->readfn/writefn in vfio_pci_config_rw_single(), and (2) a double-free when vfio_config_free() is called on device close. The fix adds a NULL assignment after kfree() to prevent pointer reuse. Attack vector requires local access to trigger device initialization failures and subsequent config operations.
Affected products
- Linux Linux kernel <= 6.13
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory