CVE-2026-63907

A flaw was found in the uio_pci_generic_sva module of the Linux kernel. This vulnerability, a double free, occurs because memory allocated with devm_kzalloc() is automatically freed, but the kfree(udev) function is also explicitly called during both error handling and device removal. A local attacker could exploit this double free to cause memory corruption, potentially leading to a denial of service (DoS) on the system.