CVE-2026-89777 - Vulnerability Details

- vfio/pci: clear vdev->msi_perm after freeing it on init failure

Description

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: clear vdev->msi_perm after freeing it on init failure

vfio_msi_cap_len() lazily allocates the per-device MSI permission table:

vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);
if (!vdev->msi_perm)
return -ENOMEM;

ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
if (ret) {
kfree(vdev->msi_perm);
return ret; /* vdev->msi_perm left dangling */
}

When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the
error path frees vdev->msi_perm but leaves the freed pointer stored in
it. vdev->msi_perm is not re-zeroed later because struct
vfio_pci_core_device is per-device and persists across open/close cycles,
and the vfio_config_init() error path returns without calling
vfio_config_free(). So the dangling pointer outlives the failed open.

That leads to two use-after-frees on the same device:

1. Reuse. The next vfio_config_init() sees the stale pointer at
"if (vdev->msi_perm) return len;" and reuses the freed object. MSI
config accesses in vfio_pci_config_rw_single() then dereference and
call the freed perm->readfn / perm->writefn function pointers.

2. Double free. A later vfio_config_free() runs free_perm_bits() and
kfree() on the already-freed object.

Fix it by NULLing vdev->msi_perm after the kfree(), matching the
NULL-after-free discipline already used in free_perm_bits() and
vfio_config_free().

BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
Read of size 8 at addr ffff88800fcc88d0 by task exploit/143
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)
vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)
vfs_read (fs/read_write.c:572)
__x64_sys_pread64 (fs/read_write.c:764)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...

Followed on device close by a double free of the same object:

Oops: general protection fault, probably for non-canonical address
0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:kfree (mm/slub.c:6711)
Call Trace:
vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)
vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)
vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)
vfio_df_close (drivers/vfio/vfio_main.c:602)
vfio_device_fops_release (drivers/vfio/vfio_main.c:648)
__fput (fs/file_table.c:512)
__x64_sys_close (fs/open.c:1496)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Kernel panic - not syncing: Fatal exception

Published: 2026-09-16

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The VFIO PCI driver leaves a dangling pointer in the device structure because the MSI permission table pointer is not cleared after a failed initialization, leading to a use‑after‑free. Subsequent openings of the same VFIO device can reuse the stale pointer, causing dereference of freed function pointers, and later attempts to free the already‑freed object result in a double‑free that can trigger a kernel panic.

Affected Systems

All Linux kernel builds that include the VFIO PCI driver are affected, regardless of version identifier in the given CPE. The vulnerability is inherent to the vfio/pci implementation across the Linux kernel source tree.

Risk and Exploitability

The EPSS score is < 1% and the CVSS score is 8.8, indicating high severity. The failure mode of a kernel panic and the possibility of executing arbitrary code make this a high‑risk flaw. It is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The attack requires local privileged access or the ability to open a VFIO device on the target system, so the likely attack vector is local privileged exploitation. An attacker with sufficient privileges could trigger the bug to compromise kernel integrity or force a reboot.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< eb84cd81040e58dd05ac190f561f2115e3367249
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< f0eea8f9013676b42289ec35941e848b8a543e19
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< d665a1688af7f8fefd7c0eb04f2a37122ce007f4
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 25cdd2a492d868cff1e519a60fe282909c52d385
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 812f1db7f0755a19ef16ecdc5cec51bcabc5eda5
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 533d0c5feef85ee6404b9f41d5564fac6971a008
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< fda8fb7e8179561693a786a7af593f6b944a21c1
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< dc77acfeb979dded39b247b60fef0399536bfa77
`ac370e3d1f3b01519d2705cd5815d1c9d0a8812b`	affected	—
`be363e27ec3c3a99793da2be6c07eafb95709c6b`	affected	—
`f1b10ba5739440ca51d66f0b2949cead88d2dd02`	affected	—
`dde3433de9a067a33d67d65b9093cad3e043e49e`	affected	—
`4.4.203`	affected	< 4.5
`4.9.203`	affected	< 4.10
`4.14.155`	affected	< 4.15
`4.19.85`	affected	< 4.20

Linux

affected

Version	Status	Constraints
`4.20`	affected	—
`0`	unaffected	< 4.20
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,eb84cd81040e58dd05ac190f561f2115e3367249)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,f0eea8f9013676b42289ec35941e848b8a543e19)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,d665a1688af7f8fefd7c0eb04f2a37122ce007f4)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,25cdd2a492d868cff1e519a60fe282909c52d385)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,812f1db7f0755a19ef16ecdc5cec51bcabc5eda5)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,533d0c5feef85ee6404b9f41d5564fac6971a008)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,fda8fb7e8179561693a786a7af593f6b944a21c1)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,dc77acfeb979dded39b247b60fef0399536bfa77)`	affected	code_commit	—
`ac370e3d1f3b01519d2705cd5815d1c9d0a8812b`	affected	code_commit	—
`be363e27ec3c3a99793da2be6c07eafb95709c6b`	affected	code_commit	—
`f1b10ba5739440ca51d66f0b2949cead88d2dd02`	affected	code_commit	—
`dde3433de9a067a33d67d65b9093cad3e043e49e`	affected	code_commit	—
`[4.4.203,4.5)`	affected	semver	—
`[4.9.203,4.10)`	affected	semver	—
`[4.14.155,4.15)`	affected	semver	—
`[4.19.85,4.20)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.20`	affected	generic	—
`[0,4.20)`	unaffected	generic	—
`5.10.270<=5.10.*`	unaffected	generic	—
`5.15.221<=5.15.*`	unaffected	generic	—
`6.1.188<=6.1.*`	unaffected	generic	—
`6.6.157<=6.6.*`	unaffected	generic	—
`6.12.110<=6.12.*`	unaffected	generic	—
`6.18.52<=6.18.*`	unaffected	generic	—
`7.2.6<=7.2.*`	unaffected	generic	—
`7.3-rc1<=*`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that clears vdev->msi_perm after freeing it during init failure
If an upgrade is not immediately possible, temporarily disable the vfio_pci module (e.g., rmmod vfio_pci or add vfio_pci to module.blacklist) to prevent the faulty initializations
Configure security policies or file permissions so that only trusted users can open VFIO devices, limiting the attack surface
Set up monitoring for KASAN or double‑free error messages in kernel logs and alert the incident response team to investigate promptly

Generated by OpenCVE AI on September 20, 2026 at 04:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00164.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385
https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008
https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5
https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4
https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77
https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249
https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19
https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1

History

Sun, 20 Sep 2026 05:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-415 CWE-416

Fri, 18 Sep 2026 11:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-415 CWE-416

Wed, 16 Sep 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-415 CWE-416

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Wed, 16 Sep 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open. That leads to two use-after-frees on the same device: 1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers. 2. Double free. A later vfio_config_free() runs free_perm_bits() and kfree() on the already-freed object. Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free(). BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Followed on device close by a double free of the same object: Oops: general protection fault, probably for non-canonical address 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI RIP: 0010:kfree (mm/slub.c:6711) Call Trace: vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861) vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685) vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777) vfio_df_close (drivers/vfio/vfio_main.c:602) vfio_device_fops_release (drivers/vfio/vfio_main.c:648) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1496) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Kernel panic - not syncing: Fatal exception
Title		vfio/pci: clear vdev->msi_perm after freeing it on init failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385 https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008 https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5 https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4 https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77 https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249 https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19 https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T08:48:17.754Z

Updated: 2026-09-16T14:38:28.611Z

Reserved: 2026-09-11T19:38:34.765Z

Link: CVE-2026-89777

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T09:17:08.073

Modified: 2026-09-16T15:18:06.997

Link: CVE-2026-89777

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T04:45:17Z

Weaknesses

CWE-415
Double Free
CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object