Linux kernel vfio/pci: freed MSI permission table left in the device, giving use-after-free and double free

Impact

When init_pci_cap_msi_perm() fails with -ENOMEM, vfio_msi_cap_len() frees vdev->msi_perm but leaves the freed pointer stored in the per-device struct, which persists across open/close cycles. The next open reuses the freed object and MSI config accesses call its freed readfn/writefn function pointers; a later vfio_config_free() frees it again. The report includes a KASAN slab-use-after-free at vfio_pci_config_rw_single() reached from pread(), and a fatal double free on close. vfio-pci is exactly how GPUs and NICs are passed through to VMs, so this sits on the path a tenant's device-assignment stack uses; a local user or process holding the vfio device fd that can drive an allocation failure gets kernel control-flow over freed function pointers and can panic the node. The fix NULLs the pointer after kfree().

Who can reach it

Local user or VMM process holding an open vfio-pci device fd (typically a passthrough host or a container granted /dev/vfio). Requires the ability to force the -ENOMEM path during device open; no remote access.

What to do

Update to a stable kernel carrying the linked commits and reboot the passthrough hosts after evacuating the VMs that hold the assigned devices. Reducing exposure means restricting who can open /dev/vfio/* until the reboot. The record lists commits only, no fixed version numbers.

References

Related entries

• Linux kernel qla2xxx: host_map btree updated without vport_slock in the format-1 path, corrupting the mapCVE-2026-89844 · Linux kernel scsi qla2xxx (report ID acquisition, vport_slock host_map)High
• Linux kernel qla2xxx: unexpected status IOCB for a non-SCSI handle causes a wild pointer dereferenceCVE-2026-89849 · Linux kernel qla2xxx (QLogic Fibre Channel HBA status IOCB fast path)High
• Linux kernel qla2xxx: re-initializing a queued work item on a repeated FC-NVMe abort corrupts the workqueue listCVE-2026-89860 · Linux kernel qla2xxx (FC-NVMe abort path, priv->abort_work)High
• KVM arm64 vgic-v3: unreferenced LPI iteration lets a freed vgic_irq be dereferenced while saving pending tablesCVE-2026-89913 · Linux kernel KVM arm64 vgic-v3 (vgic_v3_save_pending_tables LPI iteration)High
• KVM x86/mmu: lockless aging walk re-reads the rmap and can follow a pte_list_desc chain being freedCVE-2026-89928 · Linux kernel KVM x86/mmu (lockless rmap walk in kvm_rmap_age_gfn_range)High
• KVM nVMX: emulated INVVPID can run on the wrong physical CPU, leaving stale L2 TLB entriesCVE-2026-89929 · Linux kernel KVM nVMX (INVVPID emulation, wrong physical CPU)High