CVE-2026-89777 - Vulnerability Details

- vfio/pci: clear vdev->msi_perm after freeing it on init failure

Description

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: clear vdev->msi_perm after freeing it on init failure

vfio_msi_cap_len() lazily allocates the per-device MSI permission table:

vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);
if (!vdev->msi_perm)
return -ENOMEM;

ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
if (ret) {
kfree(vdev->msi_perm);
return ret; /* vdev->msi_perm left dangling */
}

When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the
error path frees vdev->msi_perm but leaves the freed pointer stored in
it. vdev->msi_perm is not re-zeroed later because struct
vfio_pci_core_device is per-device and persists across open/close cycles,
and the vfio_config_init() error path returns without calling
vfio_config_free(). So the dangling pointer outlives the failed open.

That leads to two use-after-frees on the same device:

1. Reuse. The next vfio_config_init() sees the stale pointer at
"if (vdev->msi_perm) return len;" and reuses the freed object. MSI
config accesses in vfio_pci_config_rw_single() then dereference and
call the freed perm->readfn / perm->writefn function pointers.

2. Double free. A later vfio_config_free() runs free_perm_bits() and
kfree() on the already-freed object.

Fix it by NULLing vdev->msi_perm after the kfree(), matching the
NULL-after-free discipline already used in free_perm_bits() and
vfio_config_free().

BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
Read of size 8 at addr ffff88800fcc88d0 by task exploit/143
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)
vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)
vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)
vfs_read (fs/read_write.c:572)
__x64_sys_pread64 (fs/read_write.c:764)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...

Followed on device close by a double free of the same object:

Oops: general protection fault, probably for non-canonical address
0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:kfree (mm/slub.c:6711)
Call Trace:
vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)
vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)
vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)
vfio_df_close (drivers/vfio/vfio_main.c:602)
vfio_device_fops_release (drivers/vfio/vfio_main.c:648)
__fput (fs/file_table.c:512)
__x64_sys_close (fs/open.c:1496)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Kernel panic - not syncing: Fatal exception

Published: 2026-09-16

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< eb84cd81040e58dd05ac190f561f2115e3367249
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< f0eea8f9013676b42289ec35941e848b8a543e19
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< d665a1688af7f8fefd7c0eb04f2a37122ce007f4
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 25cdd2a492d868cff1e519a60fe282909c52d385
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 812f1db7f0755a19ef16ecdc5cec51bcabc5eda5
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< 533d0c5feef85ee6404b9f41d5564fac6971a008
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< fda8fb7e8179561693a786a7af593f6b944a21c1
`30ea32ab1951c80c6113f300fce2c70cd12659e4`	affected	< dc77acfeb979dded39b247b60fef0399536bfa77
`ac370e3d1f3b01519d2705cd5815d1c9d0a8812b`	affected	—
`be363e27ec3c3a99793da2be6c07eafb95709c6b`	affected	—
`f1b10ba5739440ca51d66f0b2949cead88d2dd02`	affected	—
`dde3433de9a067a33d67d65b9093cad3e043e49e`	affected	—
`4.4.203`	affected	< 4.5
`4.9.203`	affected	< 4.10
`4.14.155`	affected	< 4.15
`4.19.85`	affected	< 4.20

Linux

affected

Version	Status	Constraints
`4.20`	affected	—
`0`	unaffected	< 4.20
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,eb84cd81040e58dd05ac190f561f2115e3367249)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,f0eea8f9013676b42289ec35941e848b8a543e19)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,d665a1688af7f8fefd7c0eb04f2a37122ce007f4)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,25cdd2a492d868cff1e519a60fe282909c52d385)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,812f1db7f0755a19ef16ecdc5cec51bcabc5eda5)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,533d0c5feef85ee6404b9f41d5564fac6971a008)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,fda8fb7e8179561693a786a7af593f6b944a21c1)`	affected	code_commit	—
`[30ea32ab1951c80c6113f300fce2c70cd12659e4,dc77acfeb979dded39b247b60fef0399536bfa77)`	affected	code_commit	—
`ac370e3d1f3b01519d2705cd5815d1c9d0a8812b`	affected	code_commit	—
`be363e27ec3c3a99793da2be6c07eafb95709c6b`	affected	code_commit	—
`f1b10ba5739440ca51d66f0b2949cead88d2dd02`	affected	code_commit	—
`dde3433de9a067a33d67d65b9093cad3e043e49e`	affected	code_commit	—
`[4.4.203,4.5)`	affected	semver	—
`[4.9.203,4.10)`	affected	semver	—
`[4.14.155,4.15)`	affected	semver	—
`[4.19.85,4.20)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.20`	affected	generic	—
`[0,4.20)`	unaffected	generic	—
`5.10.270<=5.10.*`	unaffected	generic	—
`5.15.221<=5.15.*`	unaffected	generic	—
`6.1.188<=6.1.*`	unaffected	generic	—
`6.6.157<=6.6.*`	unaffected	generic	—
`6.12.110<=6.12.*`	unaffected	generic	—
`6.18.52<=6.18.*`	unaffected	generic	—
`7.2.6<=7.2.*`	unaffected	generic	—
`7.3-rc1<=*`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385
https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008
https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5
https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4
https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77
https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249
https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19
https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1

History

Wed, 16 Sep 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-415 CWE-416

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Wed, 16 Sep 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open. That leads to two use-after-frees on the same device: 1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers. 2. Double free. A later vfio_config_free() runs free_perm_bits() and kfree() on the already-freed object. Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free(). BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Followed on device close by a double free of the same object: Oops: general protection fault, probably for non-canonical address 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI RIP: 0010:kfree (mm/slub.c:6711) Call Trace: vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861) vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685) vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777) vfio_df_close (drivers/vfio/vfio_main.c:602) vfio_device_fops_release (drivers/vfio/vfio_main.c:648) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1496) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Kernel panic - not syncing: Fatal exception
Title		vfio/pci: clear vdev->msi_perm after freeing it on init failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385 https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008 https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5 https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4 https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77 https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249 https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19 https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T08:48:17.754Z

Updated: 2026-09-16T14:38:28.611Z

Reserved: 2026-09-11T19:38:34.765Z

Link: CVE-2026-89777

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T09:17:08.073

Modified: 2026-09-16T15:18:06.997

Link: CVE-2026-89777

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-16T15:00:07Z

Weaknesses

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object