{"id":"CVE-2026-93827","published":"2026-09-24T17:17:16.410","lastModified":"2026-09-25T13:17:23.513","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-fs: avoid double-free on failed queue setup\n\nvirtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling\nvirtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both\npointers and returns an error to virtio_fs_probe().\n\nvirtio_fs_probe() then drops the last kobject reference, and\nvirtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves\ndangling pointers in struct virtio_fs and can trigger a double-free during\nprobe failure cleanup.\n\nSet fs->vqs and fs->mq_map to NULL immediately after kfree() in the\nvirtio_fs_setup_vqs() error path so that the later kobject release sees an\nuninitialized state and kfree(NULL) becomes harmless.\n\nThis can be reproduced when a broken virtio-fs device advertises more\nrequest queues than the transport actually provides. In that case\nvirtio_find_vqs() fails while setting up the extra queue, and the probe\npath reaches the double-free cleanup sequence.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/20ef4739b329bb09cff11dd2458795a50674658e","tags":[]},{"url":"https://git.kernel.org/stable/c/3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad","tags":[]},{"url":"https://git.kernel.org/stable/c/6af3330ec5d5fb8c06c04eb520a71cf73ea5a765","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}