Linux kernel (drivers/vfio/pci): Out-of-bounds read past the ecap_perms table when a tenant touches emulated PCIe

Impact

Out-of-bounds read past the ecap_perms table when a tenant touches emulated PCIe extended config space on a device whose first extended capability has to be hidden. That table is the policy that decides which config-space writes vfio lets through to real hardware, so indexing off the end means a tenant's config accesses are policed by whatever kernel bytes follow it - the emulation boundary that keeps a passthrough device inside its assignment.

Who can reach it

A tenant holding the vfio-pci device fd, doing ordinary reads/writes on the device's config-space region. No race, no special ioctl - the only precondition is a passthrough device whose first PCIe extended capability ID is above PCI_EXT_CAP_ID_MAX (an unknown or deliberately hidden capability), which vfio then has to mask by zeroing the ID in place. No host root required.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim controls: audit the extended capability list of the device models you pass through, and drop /dev/vfio device nodes from containers that do not need them.

References