CVE-2026-89777

A flaw was found in the Linux kernel's vfio/pci component. During device initialization, a memory pointer is not properly cleared after being freed, leading to a use-after-free and double-free vulnerability. A local attacker could exploit this flaw to cause a system crash, resulting in a denial of service, or potentially execute arbitrary code with elevated privileges.

A use-after-free and double-free flaw in the Linux kernel's vfio/pci subsystem has been rated Important by Red Hat. When initialization of the per-device MSI permission table fails (for example, when an underlying allocation fails with -ENOMEM), the error path in vfio_msi_cap_len() frees vdev->msi_perm but leaves the dangling pointer stored in the per-device vfio_pci_core_device structure, which persists across open/close cycles. A local attacker with access to a VFIO PCI device could trigger this failed initialization path and then, on a subsequent open or close of the device, cause the freed object to be reused for MSI config-space accesses (dereferencing and calling the freed perm->readfn/perm->writefn function pointers) or to be freed a second time in vfio_config_free(). This can lead to a kernel panic and system crash (denial of service) or potentially to execution of arbitrary code with elevated privileges. Red Hat rates this flaw as Important with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); the higher CVE.org score of 8.8 reflects a lower attack-complexity assessment, whereas Red Hat considers exploitation to depend on reliably steering a memory-allocation failure during device initialization. Within Red Hat's affected product scope, Red Hat Enterprise Linux 6 and 7 (kernel and kernel-rt ELS streams) are not affected because the vulnerable code is not present, while the vulnerable code is present in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and Red Hat OpenShift versions that ship an affected kernel, and fixes are being pursued through the responsible engineering teams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.