In the Linux kernel, the following vulnerability has been resolved:
virtio-mmio: don't break lifecycle of vm_dev
vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct.
Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called.
To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs.
The fix is easy, don't use devres in this case.
Found during my research about object lifetime problems.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade kernel-livepatch-5.10.192-182.736Upgrade perf-debuginfoUpgrade kernelUpgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.15.128-80.144Upgrade kernel-tools-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade kernel-develUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perfUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-headersUpgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.1.49-69.116Upgrade kernelUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64 | Oct 16, 2025 | Oct 1, 2025 |
| Debian | — | Upgrade linux | Oct 3, 2025 | Oct 3, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-tools | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade bpftool | Dec 12, 2025 | Dec 11, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 1, 2025 |
| Ubuntu | — | Upgrade linux-riscv-5.15Upgrade linux-azureUpgrade linux-oracle-5.4Upgrade linux-oracleUpgrade linux-azure-5.15Upgrade linux-hwe-5.15Upgrade linux-ibm-5.15Upgrade linux-nvidia-tegraUpgrade linux-raspiUpgrade linux-kvmUpgrade linux-gkeUpgrade linuxUpgrade linux-xilinx-zynqmpUpgrade linux-azure-fdeUpgrade linux-aws-fipsUpgrade linux-nvidiaUpgrade linux-oracle-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-intel-iotgUpgrade linux-aws-5.15Upgrade linux-azure-fipsUpgrade linux-fipsUpgrade linux-ibmUpgrade linux-lowlatencyUpgrade linux-aws-5.4Upgrade linux-ibm-5.4Upgrade linux-gkeopUpgrade linux-nvidia-tegra-igxUpgrade linux-realtimeUpgrade linux-iotUpgrade linux-raspi-5.4Upgrade linux-intel-iot-realtimeUpgrade linux-gcp-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-azure-5.4Upgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-5.4Upgrade linux-awsUpgrade linux-gcpUpgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-hwe-5.4 | Oct 10, 2025 | Oct 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Oct 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub