CVE-2026-63907
Received Received - Intake

Double Free in Linux Kernel uio_pci_generic_sva Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in probe(), but then calls kfree(udev) both on the probe() error path (label out_free) and again in remove(). Because devm_kzalloc() allocations are devres-managed and are freed automatically when the device is detached (including after a failing probe() and during driver unbind), the explicit kfree() can lead to a double free. If probe() fails after devm_kzalloc(), the error path frees udev and devres cleanup will free it again when the core unwinds the partially bound device. On normal driver removal, remove() frees udev and devres will free it again when the device is detached. This issue was identified by a static analysis tool I developed and confirmed by manual review. Fix by removing the manual kfree() calls and dropping the now-unused label.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63907
EUVD
EUVD-2026-45680

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a double free issue in the uio_pci_generic_sva driver. The driver allocates memory for a device structure using devm_kzalloc() in the probe function. However, it incorrectly calls kfree() to free this memory both when probe fails and during driver removal. Since devm_kzalloc() allocations are automatically freed by the device resource management system, the explicit kfree() leads to a double free, potentially causing memory corruption or system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's uio_pci_generic_sva driver and does not have a direct network detection method. To check if your system is affected, verify if the uio_pci_generic_sva driver is loaded and if the kernel version includes the vulnerable code. Use commands like 'lsmod | grep uio_pci_generic_sva' to check driver status and 'uname -r' to check the kernel version.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or undefined behavior if the affected driver is used. Attackers might exploit this to cause denial-of-service conditions or gain elevated privileges on systems running vulnerable kernel versions. Users should update their Linux kernel to a patched version to mitigate this risk.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It involves a double-free issue in the Linux kernel's uio_pci_generic_sva driver, which could lead to system instability or crashes but does not inherently impact data protection or privacy requirements.

Mitigation Strategies

Apply the kernel patch that resolves this issue by removing the manual kfree() calls in the uio_pci_generic_sva driver. Update your Linux kernel to a version that includes the fix. If immediate patching is not possible, consider disabling the uio_pci_generic_sva driver if it is not required for your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart