Linux kernel (drivers/vfio): An uninitialized pointer in the VFIO group structure is dereferenced from a group ioctl

Impact

An uninitialized pointer in the VFIO group structure is dereferenced from a group ioctl, oopsing the kernel from inside a tenant's own device-setup path. On a node configured with panic_on_oops that is a reboot for every tenant sharing it; without it the faulting task dies mid-operation holding group state.

Who can reach it

A tenant holding /dev/vfio/<group> calling the group ioctls out of the expected order - unbinding or querying before an iommufd bind has actually succeeded, so group->iommufd was never set. Plain ioctl sequence, no race to win, no host root.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: drop the /dev/vfio group node from containers that do not require passthrough, and mediate group binding through the host VMM.

References

Related entries

• Linux kernel (drivers/vfio): Uninitialized kernel stack bytes sitting in a structure hole are copied out to userspaceCVE-2023-54137 · Linux kernel (drivers/vfio)Medium
• Linux kernel (drivers/vfio): Vfio deleted the device before removing its debugfs tree, so debugfs files stay visibleCVE-2026-64473 · Linux kernel (drivers/vfio)Medium
• Linux kernel (drivers/vfio): Pinned-memory accounting for a VFIO container is lost across exec(), then underflows to aCVE-2023-53171 · Linux kernel (drivers/vfio)Medium
• Linux kernel (drivers/vfio): A blocked migration-state transition makes the vfio state machine spin forever whileCVE-2026-64474 · Linux kernel (drivers/vfio)Medium
• Linux kernel (drivers/vfio): VFIO core advertised migration ioctls for devices whose driver never actually initialisedCVE-2022-50117 · Linux kernel (drivers/vfio)Medium
• libvirt: Off-by-one in udevListInterfacesByStatus() - libvirtd crash / info leakCVE-2024-1441 · libvirtMedium