CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup
In the Linux kernel, the following vulnerability has been resolved:
virtio-fs: avoid double-free on failed queue setup
virtiofssetupvqs() allocates fs->vqs and fs->mqmap before calling virtiofindvqs(). If virtiofindvqs() fails, the error path frees both pointers and returns an error to virtiofsprobe().
virtiofsprobe() then drops the last kobject reference, and virtiofsktyperelease() frees fs->vqs and fs->mqmap again. This leaves dangling pointers in struct virtiofs and can trigger a double-free during probe failure cleanup.
Set fs->vqs and fs->mqmap to NULL immediately after kfree() in the virtiofssetupvqs() error path so that the later kobject release sees an uninitialized state and kfree(NULL) becomes harmless.
This can be reproduced when a broken virtio-fs device advertises more request queues than the transport actually provides. In that case virtiofindvqs() fails while setting up the extra queue, and the probe path reaches the double-free cleanup sequence.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the virtio_fs_setup_vqs() error path, set fs->vqs and fs->mq_map to NULL immediately after kfree() so later cleanup sees an uninitialized state and kfree(NULL) is harmless.
Event History
Frequently Asked Questions
When can this issue be triggered?
It is triggered during virtio-fs device probing when queue setup fails after virtio_fs_setup_vqs() has allocated its queue-related arrays. A reproducible case is a broken virtio-fs device that advertises more request queues than its transport provides.
What is the consequence of the failed probe path?
The queue setup error path frees the queue-related pointers, then the later kobject release frees the same dangling pointers again. This can trigger a double-free during probe failure cleanup.
What does the fix change?
The fix sets fs->vqs and fs->mq_map to NULL immediately after freeing them in the queue-setup error path. The subsequent release then performs kfree(NULL), avoiding the second free.