Linux kernel (drivers/vfio): An uninitialized pointer in the VFIO group structure is dereferenced from a group ioctl

Impact

An uninitialized pointer in the VFIO group structure is dereferenced from a group ioctl, oopsing the kernel from inside a tenant's own device-setup path. On a node configured with panic_on_oops that is a reboot for every tenant sharing it; without it the faulting task dies mid-operation holding group state.

Who can reach it

A tenant holding /dev/vfio/<group> calling the group ioctls out of the expected order - unbinding or querying before an iommufd bind has actually succeeded, so group->iommufd was never set. Plain ioctl sequence, no race to win, no host root.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: drop the /dev/vfio group node from containers that do not require passthrough, and mediate group binding through the host VMM.

References