In the Linux kernel, the pci-ep-msi path was vulnerable when an MSI allocation failed. The code freed the doorbell message array but left the endpoint structure pointing to the freed memory. Subsequent cleanup could attempt to free the already‑freed array, leading to a double‑free or use‑after‑free scenario that can corrupt kernel memory. The patch eliminates the leak and prevents overwriting existing allocations by returning -EBUSY when doorbells are already allocated.

All Linux kernel versions that contain the pci-ep-msi endpoint driver before the commit that introduces this fix are affected. This includes any distribution release whose kernel contains the original pci_epf_alloc_doorbell implementation. The vendor is Linux; the product is the Linux kernel.

The vulnerability can potentially allow an attacker with the ability to trigger MSI allocation failures on a PCI endpoint to corrupt kernel memory, which may lead to privilege escalation or denial of service. The lack of an EPSS score means exploitation probability is currently unknown, but the nature of the flaw suggests high potential severity. The vulnerability is not listed in CISA’s KEV catalog, implying no publicly known exploits, yet the kernel could be strategically targeted. An attacker would need to control a PCI endpoint or influence MSI allocation, so the attack vector is local to the host that owns the device.