Linux kernel (drivers/vfio/mdev): If creating an mdev type's sysfs entries partially fails, the parent still registers

CVSS 4.4CVE-2023-52570Kernel, userspace & hypervisorcurated

Impact

If creating an mdev type's sysfs entries partially fails, the parent still registers as successful, and later unregistration walks uninitialized type pointers and dereferences garbage. mdev is the mechanism vGPU partitioning is built on, so this sits on the code that carves one physical GPU into per-tenant devices.

Who can reach it

Needs host root: the failure is reached by an allocation failing during mdev parent registration at module load, then unloading the module. Upstream found it with fault injection. Not tenant-reachable - flagged because it is on the mdev/vGPU registration path that defines tenant device boundaries, not because a tenant can drive it.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: do not load/unload mdev parent drivers on a node carrying live tenants.

References

https://git.kernel.org/stable/c/c01b2e0ee22ef8b4dd7509a93aecc0ac0826bae4 https://git.kernel.org/stable/c/52093779b1830ac184a23848d971f06404cf513e https://nvd.nist.gov/vuln/detail/CVE-2023-52570

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.