-

CVE-2026-90130

vdpa_sim: fix cleanup after worker creation failure

In the Linux kernel, the following vulnerability has been resolved:

vdpa_sim: fix cleanup after worker creation failure

vdpasim_create() leaves vdpasim->worker as an ERR_PTR when
kthread_run_worker() fails. The error path then drops the device
reference, which releases the partially initialized simulator.

vdpasim_free() unconditionally passes the worker pointer to
kthread_destroy_worker(), so the ERR_PTR is dereferenced and can trigger
a general protection fault.

Store the worker error, clear the pointer, and only clean up the worker
when it was successfully initialized. Also make the release path tolerate
partially initialized objects by guarding virtqueue and IOTLB cleanup,
since the same release path can be reached from other initialization
failures.

I found this bug myself, though the patch was written with AI assistance.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 76acfa7bc54f1e3b9dde396e0a3534493419fd6f
Version < feafa109f031ed111f7f968e447c13985db498e0
Status affected
Version 76acfa7bc54f1e3b9dde396e0a3534493419fd6f
Version < 05ddc94afb69e36df59e88cfa9e5c7bf9d10cfd0
Status affected
Version 76acfa7bc54f1e3b9dde396e0a3534493419fd6f
Version < 68b726b3a01fb02a68843781b17d05ef3d759987
Status affected
Version 76acfa7bc54f1e3b9dde396e0a3534493419fd6f
Version < ca6f3fa599cb764518df595368b743f856fdb516
Status affected
Version 76acfa7bc54f1e3b9dde396e0a3534493419fd6f
Version < bd670e5dfd2b01fd9692f61fa1456434c54026a4
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.4
Status affected
Version 0
Version < 6.4
Status unaffected
Version <= 6.6.*
Version 6.6.157
Status unaffected
Version <= 6.12.*
Version 6.12.110
Status unaffected
Version <= 6.18.*
Version 6.18.52
Status unaffected
Version <= 7.2.*
Version 7.2.6
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.102
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/feafa109f031ed111f7f968e447c13985db498e0
https://git.kernel.org/stable/c/05ddc94afb69e36df59e88cfa9e5c7bf9d10cfd0
https://git.kernel.org/stable/c/68b726b3a01fb02a68843781b17d05ef3d759987
https://git.kernel.org/stable/c/ca6f3fa599cb764518df595368b743f856fdb516
https://git.kernel.org/stable/c/bd670e5dfd2b01fd9692f61fa1456434c54026a4