CVE-2026-93827

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virtio-fs: avoid double-free on failed queue setup

virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling

virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both

pointers and returns an error to virtio_fs_probe().

virtio_fs_probe() then drops the last kobject reference, and

virtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves

dangling pointers in struct virtio_fs and can trigger a double-free during

probe failure cleanup.

Set fs->vqs and fs->mq_map to NULL immediately after kfree() in the

virtio_fs_setup_vqs() error path so that the later kobject release sees an

uninitialized state and kfree(NULL) becomes harmless.

This can be reproduced when a broken virtio-fs device advertises more

request queues than the transport actually provides. In that case

virtio_find_vqs() fails while setting up the extra queue, and the probe

path reaches the double-free cleanup sequen

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References