In the Linux kernel, the following vulnerability has been resolved:
virtio-mmio: don't break lifecycle of vm_dev
vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct.
Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called.
To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs.
The fix is easy, don't use devres in this case.
Found during my research about object lifetime problems.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.128-80.144Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-develUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.192-182.736 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-livepatch-6.1.49-69.116Upgrade bpftool-debuginfoUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpfUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade perfUpgrade kernel-develUpgrade kernel-toolsUpgrade python3-perf | Oct 16, 2025 | Oct 1, 2025 |
| Debian | — | Upgrade linux | Oct 3, 2025 | Oct 3, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libs | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel | Dec 12, 2025 | Dec 11, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 1, 2025 |
| Ubuntu | — | Upgrade linux-gcp-5.15Upgrade linux-gcpUpgrade linux-azure-5.4Upgrade linux-intel-iot-realtimeUpgrade linux-gcp-5.4Upgrade linux-nvidia-tegra-igxUpgrade linux-raspi-5.4Upgrade linux-hwe-5.4Upgrade linux-iotUpgrade linux-realtimeUpgrade linux-gcp-fipsUpgrade linux-bluefieldUpgrade linux-intel-iotg-5.15Upgrade linux-awsUpgrade linux-lowlatency-hwe-5.15Upgrade linux-kvmUpgrade linux-gkeUpgrade linux-azureUpgrade linux-ibmUpgrade linux-ibm-5.4Upgrade linux-aws-5.4Upgrade linuxUpgrade linux-gkeopUpgrade linux-intel-iotgUpgrade linux-aws-5.15Upgrade linux-aws-fipsUpgrade linux-nvidia-tegraUpgrade linux-lowlatencyUpgrade linux-ibm-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-nvidiaUpgrade linux-raspiUpgrade linux-oracleUpgrade linux-riscv-5.15Upgrade linux-hwe-5.15Upgrade linux-azure-fipsUpgrade linux-azure-5.15Upgrade linux-oracle-5.4Upgrade linux-xilinx-zynqmpUpgrade linux-fipsUpgrade linux-oracle-5.15 | Oct 10, 2025 | Oct 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Oct 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub