CVE-2026-89777 - Vulnerability Details

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: clear vdev->msi_perm after freeing it on init failure

vfio_msi_cap_len() lazily allocates the per-device MSI permission table:

vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);
if (!vdev->msi_perm)
return -ENOMEM;

ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
if (ret) {
kfree(vdev->msi_perm);
return ret; /* vdev->msi_perm left dangling */
}

When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the
error path frees vdev->msi_perm but leaves the freed pointer stored in
it. vdev->msi_perm is not re-zeroed later because struct
vfio_pci_core_device is per-device and persists across open/close cycles,
and the vfio_config_init() error path returns without calling
vfio_config_free(). So the dangling pointer outlives the failed open.

That leads to two use-after-frees on the same device:

1. Reuse. The next vfio_config_init() sees the stale pointer at
"if (vdev->msi_perm) return len;" and reuses the freed object. MSI
config accesses in vfio_pci_config_rw_single() then dereference and
call the freed perm->readfn / perm->writefn function pointers.

2. Double free. A later vfio_config_free() runs free_perm_bits() and
kfree() on the already-freed object.

Fix it by NULLing vdev->msi_perm after the kfree(), matching the
NULL-after-free discipline already used in free_perm_bits() and
vfio_config_free().

BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
Read of size 8 at addr ffff88800fcc88d0 by task exploit/143
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)
vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)
vfs_read (fs/read_write.c:572)
__x64_sys_pread64 (fs/read_write.c:764)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...

Followed on device close by a double free of the same object:

Oops: general protection fault, probably for non-canonical address
0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:kfree (mm/slub.c:6711)
Call Trace:
vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)
vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)
vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)
vfio_df_close (drivers/vfio/vfio_main.c:602)
vfio_device_fops_release (drivers/vfio/vfio_main.c:648)
__fput (fs/file_table.c:512)
__x64_sys_close (fs/open.c:1496)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Kernel panic - not syncing: Fatal exception

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< eb84cd81040e58dd05ac190f561f2115e3367249
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< f0eea8f9013676b42289ec35941e848b8a543e19
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< d665a1688af7f8fefd7c0eb04f2a37122ce007f4
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 25cdd2a492d868cff1e519a60fe282909c52d385
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 812f1db7f0755a19ef16ecdc5cec51bcabc5eda5
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 533d0c5feef85ee6404b9f41d5564fac6971a008
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< fda8fb7e8179561693a786a7af593f6b944a21c1
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< dc77acfeb979dded39b247b60fef0399536bfa77
`ac370e3d1f3b01519d2705cd5815d1c9d0a8812b`	affected	—
`be363e27ec3c3a99793da2be6c07eafb95709c6b`	affected	—
`f1b10ba5739440ca51d66f0b2949cead88d2dd02`	affected	—
`dde3433de9a067a33d67d65b9093cad3e043e49e`	affected	—
`4.4.203`	affected	< 4.5
`4.9.203`	affected	< 4.10
`4.14.155`	affected	< 4.15
`4.19.85`	affected	< 4.20

Linux

affected

Version	Status	Constraints
`4.20`	affected	—
`0`	unaffected	< 4.20
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Project Subscriptions

Vendors	Products
Linux Subscribe	Linux Kernel Subscribe

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385
https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008
https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5
https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4
https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77
https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249
https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19
https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1

History

Wed, 16 Sep 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open. That leads to two use-after-frees on the same device: 1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers. 2. Double free. A later vfio_config_free() runs free_perm_bits() and kfree() on the already-freed object. Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free(). BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Followed on device close by a double free of the same object: Oops: general protection fault, probably for non-canonical address 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI RIP: 0010:kfree (mm/slub.c:6711) Call Trace: vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861) vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685) vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777) vfio_df_close (drivers/vfio/vfio_main.c:602) vfio_device_fops_release (drivers/vfio/vfio_main.c:648) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1496) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Kernel panic - not syncing: Fatal exception
Title		vfio/pci: clear vdev->msi_perm after freeing it on init failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385 https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008 https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5 https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4 https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77 https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249 https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19 https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T08:48:17.754Z

Updated: 2026-09-16T08:48:17.754Z

Reserved: 2026-09-11T19:38:34.765Z

Link: CVE-2026-89777

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T09:17:08.073

Modified: 2026-09-16T09:17:08.073

Link: CVE-2026-89777

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

Project Subscriptions

Projects

JSON object

JSON object

JSON object

JSON object

JSON object