Answer in brief
CVE-2026-89777 records a High severity (CVSS 8.8) vulnerability in vfio/pci: clear vdev->msi_perm after freeing it on init failure. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=30ea32ab1951c80c6113f300fce2c70cd12659e4 <eb84cd81040e58dd05ac190f561f2115e3367249 || >=30ea32ab1951c80c6113f300fce2c70cd12659e4 <f0eea8f9013676b42289ec35941e848b8a543e19 || >=30ea32ab1951c80c6113f300fce2c70cd12659e4 <d665a1688af7f8fefd7c0eb04f2a37122ce007f4 || >=30ea32ab1951c80c6113f300fce2c70cd12659e4 <25cdd2a492d868cff1e519a60fe282909c52d385 || >=30ea32ab1951c80c6113f300fce2c70cd12659e4 <812f1db7f0755a19ef16ecdc5cec51bcabc5eda5 || >=30ea32ab1951c80c6113f300fce2c70cd12659e4 <533d0c5feef85ee6404b9f41d5564fac6971a008 || >=30ea32ab1951c80c6113f300fce2c70cd12659e4 <fda8fb7e8179561693a786a7af593f6b944a21c1 || >=30ea32ab1951c80c6113f300fce2c70cd12659e4 <dc77acfeb979dded39b247b60fef0399536bfa77 || ac370e3d1f3b01519d2705cd5815d1c9d0a8812b || be363e27ec3c3a99793da2be6c07eafb95709c6b || f1b10ba5739440ca51d66f0b2949cead88d2dd02 || dde3433de9a067a33d67d65b9093cad3e043e49e || >=4.4.203 <4.5 || >=4.9.203 <4.10 || >=4.14.155 <4.15 || >=4.19.85 <4.20 | eb84cd81040e58dd05ac190f561f2115e3367249, f0eea8f9013676b42289ec35941e848b8a543e19, d665a1688af7f8fefd7c0eb04f2a37122ce007f4, 25cdd2a492d868cff1e519a60fe282909c52d385, 812f1db7f0755a19ef16ecdc5cec51bcabc5eda5, 533d0c5feef85ee6404b9f41d5564fac6971a008, fda8fb7e8179561693a786a7af593f6b944a21c1, dc77acfeb979dded39b247b60fef0399536bfa77, 4.5, 4.10, 4.15, 4.20 |
| Linux/Linuxgeneric | 4.20 | Not reported |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open. That leads to two use-after-frees on the same device: 1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers. 2. Double free. A later vfio_config_free() runs free_perm_bits() and kfree() on the already-freed object. Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free(). BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Followed on device close by a double free of the same object: Oops: general protection fault, probably for non-canonical address 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI RIP: 0010:kfree (mm/slub.c:6711) Call Trace: vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861) vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685) vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777) vfio_df_close (drivers/vfio/vfio_main.c:602) vfio_device_fops_release (drivers/vfio/vfio_main.c:648) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1496) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Kernel panic - not syncing: Fatal exception
Quoted source text, attributed separately from HOL analysis.