Linux kernel (drivers/vfio/pci): If vfio-pci device registration fails after the device joined the VGA arbiter, the

Impact

If vfio-pci device registration fails after the device joined the VGA arbiter, the arbiter keeps a callback registered against a vfio device cookie that is about to be freed. The VGA arbiter then calls into freed state on the next arbitration - a use-after-free on a node where a GPU failed to bind for passthrough, and the upstream note is explicit that it becomes exploitable again as soon as the callback follows drvdata.

Who can reach it

Requires a vfio-pci registration failure on a VGA-class device, so the trigger is host-side provisioning: binding a GPU to vfio-pci where a later registration step fails. Not tenant-initiated. Reachable only on devices that participate in VGA arbitration, which in practice means display-capable GPUs rather than headless datacenter accelerators.

What to do

Update to a stable kernel carrying commits 0f2a35a0 / 8d65decd (5.10.261 / 5.12 / 5.13 are listed by the CNA for older branches). Interim: treat any vfio-pci bind failure on a VGA-capable GPU as requiring a node reboot before the device is offered to a tenant.

References