Linux virtio-mmio: use-after-free of vm_dev when the platform device is unbound

Impact

virtio-mmio allocated its vm_dev structure with devres, so the memory is released when the platform device goes away rather than when the embedded struct device's release callback runs, giving a use-after-free on unbind. This is the virtio transport used by lightweight VMMs; on a GPU fleet that matters where guests run under Firecracker or a QEMU configuration using MMIO virtio rather than PCI. Reaching it requires driver unbind through sysfs, which is a root operation on the host, so the realistic impact is host instability during administrative teardown rather than a tenant-reachable escalation.

Who can reach it

Local, root on the host: unbinding the virtio-mmio platform device via sysfs. Not reachable from inside a guest or a container.

What to do

Patch the host kernel to a stable release with the fix (the driver stops using devres for vm_dev) and reboot the node after draining it. Avoid sysfs unbind of virtio-mmio devices on unpatched hosts in the meantime.

References

Related entries

• Linux cgroup freezer: lock inversion between cpu_hotplug_lock and freezer_mutex can deadlockCVE-2023-53522 · Linux kernel cgroup v1 freezer (cpu_hotplug_lock vs freezer_mutex ordering)High
• Linux vdpa: missing netlink attribute policy allows out-of-bounds read on vdpa configCVE-2023-53543 · Linux kernel vdpa netlink interface (missing nla_policy for max vqp attribute)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2023-53552 · Linux i915 GPU kernel driverHigh
• Linux kernel LIO iSCSI target: per-connection configfs output overflows the buffer with enough sessionsCVE-2023-53676 · Linux kernel iSCSI target (LIO lio_target_nacl_info_show configfs output)High
• Linux kernel arm64 SME: fixed 8-byte FFR clear corrupts memory past the SVE context structCVE-2023-53713 · Linux kernel arm64 SME signal/context save (FFR field clear)High
• Linux kernel (net/smc): Closing an SMC socket can leave the internal TCP kernel socket with its timers still armed andCVE-2023-53781 · Linux kernel (net/smc)High