Linux kernel (drivers/vfio): Uninitialized kernel stack bytes sitting in a structure hole are copied out to userspace

Impact

Uninitialized kernel stack bytes sitting in a structure hole are copied out to userspace through the VFIO container's info ioctl. A tenant reads back kernel stack contents it was never meant to see - small on its own, but exactly the kind of leak used to infer layout or recover a pointer before a heavier bug is fired.

Who can reach it

Any tenant holding /dev/vfio/vfio calling VFIO_IOMMU_GET_INFO on its own container. One ioctl, no race, no host root, no hardware precondition beyond the legacy type1 container being in use.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: drop /dev/vfio from containers that do not need passthrough - there is no way to filter a single capability out of the info ioctl.

References