Executive brief
The Linux kernel's vDPA simulator driver fails to safely clean up resources when its background worker thread creation fails. This can cause a crash (general protection fault) when the driver attempts to release a partially initialized device, potentially disrupting virtual I/O operations on systems using vDPA virtualization.
Technical details
The vulnerability is a resource cleanup bug in vdpa_sim's device initialization logic. When kthread_run_worker() fails, the code stores an error pointer (ERR_PTR) in vdpasim->worker. The error path then drops the device reference, triggering vdpasim_free(). The free function unconditionally passes the worker pointer to kthread_destroy_worker(), dereferencing an invalid error pointer and causing a general protection fault. The fix clears the worker pointer to NULL on creation failure and guards cleanup operations (worker teardown, virtqueue cleanup, IOTLB reset) with NULL checks to tolerate partially initialized objects. Patch is available in the Linux kernel stable tree (commit bd670e5dfd2b01fd9692f61fa1456434c54026a4).
Affected products
- Linux Linux kernel multiple versions affected (patched in 2026-09-14)
Timeline
- 2026-09-17: disclosed: Published as CVE-2026-90130
- 2026-09-14: patched: Fix committed to Linux kernel stable tree (upstream commit bd670e5dfd2b01fd9692f61fa1456434c54026a4)