Use-after-free in Linux kernel - CVE-2026-89777
Published: September 17, 2026
Vulnerability identifier: #VU150503
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89777
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.
The vulnerability exists due to use-after-free caused by a dangling pointer in vfio pci MSI permission-table handling when MSI permission-table initialization fails. A local user can cause MSI permission-table initialization to fail and subsequently access MSI configuration to compromise system confidentiality, integrity, and availability.
The per-device structure persists across open and close cycles.
Affected software
Linux kernel
How to mitigate CVE-2026-89777
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/25cdd2a492d868cff1e519a60fe282909c52d385
- https://git.kernel.org/stable/c/533d0c5feef85ee6404b9f41d5564fac6971a008
- https://git.kernel.org/stable/c/812f1db7f0755a19ef16ecdc5cec51bcabc5eda5
- https://git.kernel.org/stable/c/d665a1688af7f8fefd7c0eb04f2a37122ce007f4
- https://git.kernel.org/stable/c/dc77acfeb979dded39b247b60fef0399536bfa77
- https://git.kernel.org/stable/c/eb84cd81040e58dd05ac190f561f2115e3367249
- https://git.kernel.org/stable/c/f0eea8f9013676b42289ec35941e848b8a543e19
- https://git.kernel.org/stable/c/fda8fb7e8179561693a786a7af593f6b944a21c1