Linux kernel xen/privcmd: partial munmap of a privcmd mapping leads to a double free (XSA-487)

Impact

privcmd_vm_ops defines .close but neither .may_split nor .open, so a partial munmap() of a privcmd mapping splits the VMA and both halves end up pointing at the same pages array in vm_private_data. Closing one half frees the array and the unpopulated pages; closing the other frees them again. A double free of a kernel allocation is a kernel-memory-corruption primitive, so the practical worst case for a Xen host is a crash of dom0 or a privileged driver domain, with privilege escalation inside that domain not ruled out. The exposed path is the Xen privcmd device, which is how toolstack and driver-domain components drive hypercalls - on a virtualized GPU host that means the control domain that owns the PCI passthrough and the guests, so a crash takes the node and every VM pinned to its GPUs down with it. Reachable only by a process that already has the privcmd device open, which on a normal host is root or the toolstack.

Who can reach it

Local, on a Xen host: a process with access to /dev/xen/privcmd (dom0 root, the toolstack, or a driver domain with that device) that performs a partial munmap() of a privcmd mapping. Not reachable from an unprivileged guest and not reachable at all on hosts that are not running Xen.

What to do

Take the stable kernel fix that adds a .may_split callback denying the split (fix is in the mainline and stable trees; the stable commits are linked from the record). Applying it means installing a patched kernel and rebooting the Xen host, which for a GPU host means draining and migrating or stopping every guest on it first. There is no runtime mitigation other than not granting privcmd access, which is not practical for a working toolstack.

References

Related entries

• uutils coreutils: chroot --userspec resolves the user inside the new root, loading attacker NSS modules as rootCVE-2026-35368 · uutils coreutils `chroot --userspec` (NSS module load after chroot)High
• sudo: failed setuid/setgid/setgroups before running the mailer is non-fatal, allowing privilege escalationCVE-2026-35535 · sudo (privilege drop before invoking the mailer)High
• QEMU: guest-triggered out-of-bounds write when a physical memory map returns shortCVE-2026-3842 · QEMU (cpu_physical_memory_map short-mapping handling)High
• Linux kernel BPF verifier: atomic-fetch precision gap lets equivalent-looking states be prunedCVE-2026-43009 · Linux kernel BPF verifier (precision backtracking for atomic fetch instructions)High
• Linux kernel sockmap: use-after-free of sk->sk_socket when an AF_UNIX peer is orphanedCVE-2026-43016 · Linux kernel BPF sockmap (sk_psock_verdict_data_ready)High
• Linux kernel BPF verifier: regsafe() wrongly prunes states when old range is BEYOND_PKT_ENDCVE-2026-43030 · Linux kernel BPF verifier (regsafe() packet pointer range comparison)High