Linux kernel (drivers/vfio/pci): The error path of the vfio-pci dma-buf export falls through the whole unwind chain

CVSS 7.8CVE-2026-31468Kernel, userspace & hypervisorcurated

Impact

The error path of the vfio-pci dma-buf export falls through the whole unwind chain after the dma-buf was already exported, producing a double free of the allocated objects and an unbalanced reference count on the vfio device itself. A tenant that can steer the export into its error path gets a double free in the kernel - the classic starting point for host privilege escalation - and can drop the device's refcount below what is live.

Who can reach it

A tenant holding /dev/vfio/<group> calls the dma-buf export ioctl while its own file-descriptor table is exhausted, which it controls simply by opening files up to RLIMIT_NOFILE. That makes the 'unlikely' fd-allocation failure a deliberate, repeatable trigger rather than a rare accident. Conditional on the vfio-pci dma-buf export feature being available; no host privilege.

What to do

Update to a stable kernel carrying commits 83ad334a / e98137f0. Interim: do not enable the vfio-pci dma-buf export feature for tenant devices, and cap per-container file-descriptor limits so the error path is harder to reach on demand.

References

https://git.kernel.org/stable/c/83ad334afc9a645cef1062f5346526b1e36d6516 https://git.kernel.org/stable/c/e98137f0a874ab36d0946de4707aa48cb7137d1c https://nvd.nist.gov/vuln/detail/CVE-2026-31468

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.