Executive brief
A memory safety flaw in the Linux kernel's virtio persistent memory (nvdimm) driver allows freed memory to be accessed during request completion. This can lead to system crashes or potentially allow an attacker with local access to execute arbitrary code, compromising system stability and security.
Technical details
The vulnerability is a use-after-free in the virtio_pmem driver's request completion path. When virtio_pmem_flush() returns and frees a request token while it is still referenced in the virtqueue, the subsequent virtio_pmem_host_ack() callback attempts to wake the already-freed request structure, triggering a slab-use-after-free condition detected by KASAN. The fix implements reference counting on struct virtio_pmem_request: the submitter holds one reference and the virtqueue holds a second reference while the request is queued; the completion handler drops the virtqueue reference and the submitter drops its reference before returning. Attack requires local access to trigger persistent memory operations through the nvdimm subsystem.
Affected products
- Linux Linux kernel 6.19.0-next and earlier versions with virtio_pmem support
Timeline
- 2026-09-17: disclosed