159 lines
9.4 KiB
JSON
159 lines
9.4 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-93827",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-18T17:59:28.792Z",
|
|
"datePublished": "2026-09-24T16:03:05.795Z",
|
|
"dateUpdated": "2026-09-25T12:43:36.887Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-09-25T12:43:36.887Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-fs: avoid double-free on failed queue setup\n\nvirtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling\nvirtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both\npointers and returns an error to virtio_fs_probe().\n\nvirtio_fs_probe() then drops the last kobject reference, and\nvirtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves\ndangling pointers in struct virtio_fs and can trigger a double-free during\nprobe failure cleanup.\n\nSet fs->vqs and fs->mq_map to NULL immediately after kfree() in the\nvirtio_fs_setup_vqs() error path so that the later kobject release sees an\nuninitialized state and kfree(NULL) becomes harmless.\n\nThis can be reproduced when a broken virtio-fs device advertises more\nrequest queues than the transport actually provides. In that case\nvirtio_find_vqs() fails while setting up the extra queue, and the probe\npath reaches the double-free cleanup sequence."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 8.4,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The triggering field is virtio_fs_config.num_request_queues, read by virtio_cread_le() in virtio_fs_setup_vqs() from virtio_fs_probe() via virtio_dev_probe() after virtio_pci_probe()/register_virtio_device() binds a VIRTIO_ID_FS device; those bytes come from local PCI/MMIO/vDPA config space, not a network protocol message.\nAC:L - A device that advertises more request queues than it exposes makes virtio_find_vqs()->vp_setup_vq() fail (-EINVAL when index >= vp_modern_get_num_queues(), or -ENOENT on queue size 0); virtio_fs_setup_vqs() then kfree's fs->vqs and fs->mq_map and virtio_fs_probe() always kobject_put()s into the second free, with no race.\nPR:N - virtio_fs_probe()/virtio_fs_setup_vqs() have no capable() or credential check; MODULE_DEVICE_TABLE(virtio, id_table) autoloads virtiofs and virtio_dev_probe() binds a VIRTIO_ID_FS device at enumeration or hotplug, so a malicious virtio-fs backend needs no account on the guest.\nUI:N - The double-free runs in the probe error path (virtio_fs_setup_vqs() failure, then kobject_put() into virtio_fs_ktype_release()) when the device appears; virtio_fs_add_instance() and a virtiofs mount are never reached, so no victim must mount or open anything.\nS:U - virtio_fs_ktype_release() double-frees the guest kernel kmalloc objects fs->vqs and fs->mq_map; that is device-to-guest heap corruption inside the same guest kernel, not a write into host virtiofsd or a KVM/IOMMU escape.\nC:H - kfree(fs->vqs) and kfree(fs->mq_map) in virtio_fs_setup_vqs() leave dangling pointers that virtio_fs_ktype_release() frees again; a slab double-free of that virtio_fs_vq array and per-CPU mq_map lets those objects overlap so the attacker can read adjacent kernel heap.\nI:H - The same second kfree of fs->vqs and fs->mq_map corrupts the SLUB freelist for those kmalloc objects and is an arbitrary-free primitive, enabling heap overwrite and control-flow hijack in the guest kernel.\nA:H - Double-free of fs->vqs and fs->mq_map in virtio_fs_ktype_release() after virtio_find_vqs() fails oopses or panics the guest during probe cleanup (KASAN invalid-free, SLUB poisoned-freelist BUG, or panic_on_oops)."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/fuse/virtio_fs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9",
|
|
"lessThan": "3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9",
|
|
"lessThan": "20ef4739b329bb09cff11dd2458795a50674658e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9",
|
|
"lessThan": "6af3330ec5d5fb8c06c04eb520a71cf73ea5a765",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/fuse/virtio_fs.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.9",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.9",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.111",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.53",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.9",
|
|
"versionEndExcluding": "6.12.111"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.9",
|
|
"versionEndExcluding": "6.18.53"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.9",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/20ef4739b329bb09cff11dd2458795a50674658e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6af3330ec5d5fb8c06c04eb520a71cf73ea5a765"
|
|
}
|
|
],
|
|
"title": "virtio-fs: avoid double-free on failed queue setup",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |