CVE-2026-89777

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: clear vdev->msi_perm after freeing it on init failure

vfio_msi_cap_len() lazily allocates the per-device MSI permission table:

vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);

if (!vdev->msi_perm)

return -ENOMEM;

ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);

if (ret) {

kfree(vdev->msi_perm);

return ret; /* vdev->msi_perm left dangling */

}

When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the

error path frees vdev->msi_perm but leaves the freed pointer stored in

it. vdev->msi_perm is not re-zeroed later because struct

vfio_pci_core_device is per-device and persists across open/close cycles,

and the vfio_config_init() error path returns without calling

vfio_config_free(). So the dangling pointer outlives the failed open.

That leads to two use-after-frees on the same device:

1. Reuse. The next vfio_config_init() sees the stale pointer at

"i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References