GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89777 (GCVE-0-2026-89777)

Vulnerability from cvelistv5 – Published: 2026-09-16 08:48 – Updated: 2026-09-16 14:38
VLAI
Title
vfio/pci: clear vdev->msi_perm after freeing it on init failure
Summary
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open. That leads to two use-after-frees on the same device: 1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers. 2. Double free. A later vfio_config_free() runs free_perm_bits() and kfree() on the already-freed object. Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free(). BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Followed on device close by a double free of the same object: Oops: general protection fault, probably for non-canonical address 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI RIP: 0010:kfree (mm/slub.c:6711) Call Trace: vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861) vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685) vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777) vfio_df_close (drivers/vfio/vfio_main.c:602) vfio_device_fops_release (drivers/vfio/vfio_main.c:648) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1496) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Kernel panic - not syncing: Fatal exception
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 30ea32ab1951c80c6113f300fce2c70cd12659e4 , < eb84cd81040e58dd05ac190f561f2115e3367249 (git)
Affected: 30ea32ab1951c80c6113f300fce2c70cd12659e4 , < f0eea8f9013676b42289ec35941e848b8a543e19 (git)
Affected: 30ea32ab1951c80c6113f300fce2c70cd12659e4 , < d665a1688af7f8fefd7c0eb04f2a37122ce007f4 (git)
Affected: 30ea32ab1951c80c6113f300fce2c70cd12659e4 , < 25cdd2a492d868cff1e519a60fe282909c52d385 (git)
Affected: 30ea32ab1951c80c6113f300fce2c70cd12659e4 , < 812f1db7f0755a19ef16ecdc5cec51bcabc5eda5 (git)
Affected: 30ea32ab1951c80c6113f300fce2c70cd12659e4 , < 533d0c5feef85ee6404b9f41d5564fac6971a008 (git)
Affected: 30ea32ab1951c80c6113f300fce2c70cd12659e4 , < fda8fb7e8179561693a786a7af593f6b944a21c1 (git)
Affected: 30ea32ab1951c80c6113f300fce2c70cd12659e4 , < dc77acfeb979dded39b247b60fef0399536bfa77 (git)
Affected: ac370e3d1f3b01519d2705cd5815d1c9d0a8812b (git)
Affected: be363e27ec3c3a99793da2be6c07eafb95709c6b (git)
Affected: f1b10ba5739440ca51d66f0b2949cead88d2dd02 (git)
Affected: dde3433de9a067a33d67d65b9093cad3e043e49e (git)
Affected: 4.4.203 , < 4.5 (semver)
Affected: 4.9.203 , < 4.10 (semver)
Affected: 4.14.155 , < 4.15 (semver)
Affected: 4.19.85 , < 4.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_config.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eb84cd81040e58dd05ac190f561f2115e3367249",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "f0eea8f9013676b42289ec35941e848b8a543e19",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "d665a1688af7f8fefd7c0eb04f2a37122ce007f4",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "25cdd2a492d868cff1e519a60fe282909c52d385",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "812f1db7f0755a19ef16ecdc5cec51bcabc5eda5",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "533d0c5feef85ee6404b9f41d5564fac6971a008",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "fda8fb7e8179561693a786a7af593f6b944a21c1",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "lessThan": "dc77acfeb979dded39b247b60fef0399536bfa77",
              "status": "affected",
              "version": "30ea32ab1951c80c6113f300fce2c70cd12659e4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ac370e3d1f3b01519d2705cd5815d1c9d0a8812b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "be363e27ec3c3a99793da2be6c07eafb95709c6b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1b10ba5739440ca51d66f0b2949cead88d2dd02",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dde3433de9a067a33d67d65b9093cad3e043e49e",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.203",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.203",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.155",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.85",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_config.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.155",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.85",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure\n\nvfio_msi_cap_len() lazily allocates the per-device MSI permission table:\n\n\tvdev-\u003emsi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);\n\tif (!vdev-\u003emsi_perm)\n\t\treturn -ENOMEM;\n\n\tret = init_pci_cap_msi_perm(vdev-\u003emsi_perm, len, flags);\n\tif (ret) {\n\t\tkfree(vdev-\u003emsi_perm);\n\t\treturn ret;\t\t/* vdev-\u003emsi_perm left dangling */\n\t}\n\nWhen init_pci_cap_msi_perm() -\u003e alloc_perm_bits() fails with -ENOMEM, the\nerror path frees vdev-\u003emsi_perm but leaves the freed pointer stored in\nit. vdev-\u003emsi_perm is not re-zeroed later because struct\nvfio_pci_core_device is per-device and persists across open/close cycles,\nand the vfio_config_init() error path returns without calling\nvfio_config_free(). So the dangling pointer outlives the failed open.\n\nThat leads to two use-after-frees on the same device:\n\n1. Reuse. The next vfio_config_init() sees the stale pointer at\n   \"if (vdev-\u003emsi_perm) return len;\" and reuses the freed object. MSI\n   config accesses in vfio_pci_config_rw_single() then dereference and\n   call the freed perm-\u003ereadfn / perm-\u003ewritefn function pointers.\n\n2. Double free. A later vfio_config_free() runs free_perm_bits() and\n   kfree() on the already-freed object.\n\nFix it by NULLing vdev-\u003emsi_perm after the kfree(), matching the\nNULL-after-free discipline already used in free_perm_bits() and\nvfio_config_free().\n\n  BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\n  Read of size 8 at addr ffff88800fcc88d0 by task exploit/143\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\n   vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)\n   vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)\n   vfs_read (fs/read_write.c:572)\n   __x64_sys_pread64 (fs/read_write.c:764)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   ...\n\nFollowed on device close by a double free of the same object:\n\n  Oops: general protection fault, probably for non-canonical address\n    0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI\n  RIP: 0010:kfree (mm/slub.c:6711)\n  Call Trace:\n   vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)\n   vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)\n   vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)\n   vfio_df_close (drivers/vfio/vfio_main.c:602)\n   vfio_device_fops_release (drivers/vfio/vfio_main.c:648)\n   __fput (fs/file_table.c:512)\n   __x64_sys_close (fs/open.c:1496)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   ...\n  Kernel panic - not syncing: Fatal exception"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only via local VFIO char-device operations: open of /dev/vfio/$GROUP or /dev/vfio/devices/vfioN, then pread/pwrite of the PCI config region through vfio_pci_core_read/write into vfio_pci_config_rw_single(). There is no network or packet path into vfio_msi_cap_len().\nAC:L - After any failed vfio_config_init() plants the dangling vdev-\u003emsi_perm, the attacker retries GET_DEVICE_FD/BIND_IOMMUFD on the same persistent vdev and deterministically calls the freed perm-\u003ereadfn/writefn via MSI config accesses. The attacker controls that open/read sequence; no victim race or uncontrolled layout is required.\nPR:L - vfio_pci_core_enable() and vfio_pci_config_rw() have no capable() check on the normal IOMMU path (CAP_SYS_RAWIO is only for noiommu). Access is gated by /dev/vfio node permissions, which libvirt, kubevirt, and cloud GPU/NIC passthrough routinely grant to an unprivileged qemu user or tenant.\nUI:N - The attacker performs the VFIO open, retry, and MSI config-space pread/pwrite themselves. Prior admin binding of the PCI device to vfio-pci is deployment configuration, not victim interaction during exploitation.\nS:C - struct vfio_pci_core_device persists across open/close, so a failed open can leave a dangling msi_perm that a later tenant VM reuses. QEMU services guest PCI config cycles with VFIO pread/pwrite, so a passthrough guest can invoke the freed host function pointers and cross the VFIO/IOMMU guest-to-host boundary.\nC:H - The next successful open reuses the freed perm_bits and MSI config reads call perm-\u003ereadfn on that object. Reclaiming the slab slot yields an arbitrary kernel-read primitive, which CVSS kernel guidance scores High for use-after-free.\nI:H - MSI config writes call the freed perm-\u003ewritefn, and a later close double-frees the same object in vfio_config_free(). That UAF/double-free of a structure with function pointers is exploitable for arbitrary kernel write and control-flow hijack.\nA:H - The report shows a KASAN slab-use-after-free in vfio_pci_config_rw_single() followed by a general-protection fault in kfree() during vfio_config_free() that panics the host, so availability impact is a kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:38:28.611Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19"
        },
        {
          "url": "https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385"
        },
        {
          "url": "https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5"
        },
        {
          "url": "https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008"
        },
        {
          "url": "https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77"
        }
      ],
      "title": "vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89777",
    "datePublished": "2026-09-16T08:48:17.754Z",
    "dateReserved": "2026-09-11T19:38:34.765Z",
    "dateUpdated": "2026-09-16T14:38:28.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89777",
      "date": "2026-09-17",
      "epss": "0.00159",
      "percentile": "0.05506"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-17T01:09:50.000Z",
      "cve": "CVE-2026-89777",
      "id": "msrc_CVE-2026-89777",
      "initial_release_date": "2026-09-17T01:09:50.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89777.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89777\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-16T09:17:08.073\",\"lastModified\":\"2026-09-16T15:18:06.997\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure\\n\\nvfio_msi_cap_len() lazily allocates the per-device MSI permission table:\\n\\n\\tvdev-\u003emsi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT);\\n\\tif (!vdev-\u003emsi_perm)\\n\\t\\treturn -ENOMEM;\\n\\n\\tret = init_pci_cap_msi_perm(vdev-\u003emsi_perm, len, flags);\\n\\tif (ret) {\\n\\t\\tkfree(vdev-\u003emsi_perm);\\n\\t\\treturn ret;\\t\\t/* vdev-\u003emsi_perm left dangling */\\n\\t}\\n\\nWhen init_pci_cap_msi_perm() -\u003e alloc_perm_bits() fails with -ENOMEM, the\\nerror path frees vdev-\u003emsi_perm but leaves the freed pointer stored in\\nit. vdev-\u003emsi_perm is not re-zeroed later because struct\\nvfio_pci_core_device is per-device and persists across open/close cycles,\\nand the vfio_config_init() error path returns without calling\\nvfio_config_free(). So the dangling pointer outlives the failed open.\\n\\nThat leads to two use-after-frees on the same device:\\n\\n1. Reuse. The next vfio_config_init() sees the stale pointer at\\n   \\\"if (vdev-\u003emsi_perm) return len;\\\" and reuses the freed object. MSI\\n   config accesses in vfio_pci_config_rw_single() then dereference and\\n   call the freed perm-\u003ereadfn / perm-\u003ewritefn function pointers.\\n\\n2. Double free. A later vfio_config_free() runs free_perm_bits() and\\n   kfree() on the already-freed object.\\n\\nFix it by NULLing vdev-\u003emsi_perm after the kfree(), matching the\\nNULL-after-free discipline already used in free_perm_bits() and\\nvfio_config_free().\\n\\n  BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\\n  Read of size 8 at addr ffff88800fcc88d0 by task exploit/143\\n  Call Trace:\\n   ...\\n   kasan_report (mm/kasan/report.c:595)\\n   vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961)\\n   vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986)\\n   vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599)\\n   vfs_read (fs/read_write.c:572)\\n   __x64_sys_pread64 (fs/read_write.c:764)\\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\\n   ...\\n\\nFollowed on device close by a double free of the same object:\\n\\n  Oops: general protection fault, probably for non-canonical address\\n    0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI\\n  RIP: 0010:kfree (mm/slub.c:6711)\\n  Call Trace:\\n   vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861)\\n   vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685)\\n   vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777)\\n   vfio_df_close (drivers/vfio/vfio_main.c:602)\\n   vfio_device_fops_release (drivers/vfio/vfio_main.c:648)\\n   __fput (fs/file_table.c:512)\\n   __x64_sys_close (fs/open.c:1496)\\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\\n   ...\\n  Kernel panic - not syncing: Fatal exception\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/vfio/pci/vfio_pci_config.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"30ea32ab1951c80c6113f300fce2c70cd12659e4\",\"lessThan\":\"eb84cd81040e58dd05ac190f561f2115e3367249\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"30ea32ab1951c80c6113f300fce2c70cd12659e4\",\"lessThan\":\"f0eea8f9013676b42289ec35941e848b8a543e19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"30ea32ab1951c80c6113f300fce2c70cd12659e4\",\"lessThan\":\"d665a1688af7f8fefd7c0eb04f2a37122ce007f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"30ea32ab1951c80c6113f300fce2c70cd12659e4\",\"lessThan\":\"25cdd2a492d868cff1e519a60fe282909c52d385\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"30ea32ab1951c80c6113f300fce2c70cd12659e4\",\"lessThan\":\"812f1db7f0755a19ef16ecdc5cec51bcabc5eda5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"30ea32ab1951c80c6113f300fce2c70cd12659e4\",\"lessThan\":\"533d0c5feef85ee6404b9f41d5564fac6971a008\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"30ea32ab1951c80c6113f300fce2c70cd12659e4\",\"lessThan\":\"fda8fb7e8179561693a786a7af593f6b944a21c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"30ea32ab1951c80c6113f300fce2c70cd12659e4\",\"lessThan\":\"dc77acfeb979dded39b247b60fef0399536bfa77\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ac370e3d1f3b01519d2705cd5815d1c9d0a8812b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"be363e27ec3c3a99793da2be6c07eafb95709c6b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f1b10ba5739440ca51d66f0b2949cead88d2dd02\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dde3433de9a067a33d67d65b9093cad3e043e49e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.4.203\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.203\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.155\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.85\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/vfio/pci/vfio_pci_config.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.110\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.52\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.6\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-09-16T15:35:53Z",
      "cve": "CVE-2026-89777",
      "id": "CVE-2026-89777",
      "initial_release_date": "2026-09-16T15:35:53Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89777",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89777.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.