CVE-2026-89777

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vfio/pci component where the vdev->msi perm pointer is not cleared after being freed during an initialization failure. When the init pci cap msi perm() function (which calls alloc perm bits()) fails due to memory exhaustion, the error path frees the memory but leaves a dangling pointer in vdev->msi perm. Because the vfio pci core device structure persists across open and close cycles, this dangling pointer can lead to two scenarios: first, a subsequent call to vfio config init() may reuse the freed object, causing vfio pci config rw single() to dereference invalid function pointers; second, a later call to vfio config free() may attempt to free the same memory again, resulting in a double free. These conditions can lead to a kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.