CVE-2026-53067: Linux Kernel Privilege Escalation Flaw

CVE-2026-53067 Overview

CVE-2026-53067 is a Linux kernel vulnerability in the PCI endpoint Message Signaled Interrupt (MSI) subsystem. The flaw resides in the pci_epf_alloc_doorbell() function within pci-ep-msi. The function stores the allocated doorbell message array in epf->db_msg and epf->num_db before requesting MSI vectors. If MSI vector allocation fails, the array is freed while the Endpoint Function (EPF) state still references the freed memory, creating a use-after-free and potential double-free condition during later cleanup.

Critical Impact
A failed MSI allocation path leaves dangling pointers in the PCI endpoint function state, enabling double-free conditions and potential memory corruption in kernel space.

Affected Products

Linux kernel branches containing the pci-ep-msi doorbell allocation code
Systems using PCI endpoint framework with MSI doorbells
Stable kernel trees referenced in the upstream commits

Discovery Timeline

2026-06-24 - CVE-2026-53067 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53067

Vulnerability Analysis

The vulnerability sits in the PCI endpoint MSI doorbell allocation logic. The function pci_epf_alloc_doorbell() assigns the doorbell message buffer to the EPF state structure fields epf->db_msg and epf->num_db before invoking MSI vector allocation. When the MSI request subsequently fails, the cleanup path frees the buffer but does not clear those state fields. Later cleanup routines or retried allocations observe stale pointers and may free the same allocation again or overwrite an existing one.

The upstream fix clears epf->db_msg and epf->num_db on the MSI allocation failure path. The patch also makes pci_epf_alloc_doorbell() return -EBUSY when doorbells have already been allocated. This prevents callers from overwriting or leaking a prior allocation when retrying.

Root Cause

The root cause is improper error unwind ordering. State pointers were published into the EPF structure before the dependent MSI vector allocation succeeded. The failure path freed memory without invalidating the published references, producing a window where freed memory remained reachable through the EPF state.

Attack Vector

Exploitation requires local interaction with the PCI endpoint framework, typically through a privileged userspace component or kernel driver that drives EPF configuration. Triggering repeated doorbell allocation failures can force the cleanup path to operate on freed pointers. The condition is reachable only on systems exposing the PCI endpoint controller interface.

No verified public proof-of-concept code is available. See the upstream commits for the precise call graph and corrected error-handling sequence: Kernel commit 175717cfc06c, Kernel commit 1cba96c0a795, and Kernel commit 3c25587fbf87.

Detection Methods for CVE-2026-53067

Indicators of Compromise

Kernel log entries showing repeated MSI allocation failures in the PCI endpoint subsystem
Slab allocator warnings referencing double-free or invalid free on db_msg allocations
Crash dumps or KASAN reports implicating pci_epf_alloc_doorbell() or downstream EPF cleanup functions

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface use-after-free and double-free conditions in the PCI endpoint code path
Audit running kernel versions across Linux fleets and compare against the fixed stable kernel commits
Review EPF driver code paths that retry doorbell allocation after failure for stale pointer reuse

Monitoring Recommendations

Forward dmesg and kernel ring buffer telemetry to a centralized log platform and alert on pci-epf and MSI subsystem errors
Track kernel panics and oops events on systems running PCI endpoint workloads
Monitor package management activity to confirm timely deployment of kernel updates carrying the upstream fix

How to Mitigate CVE-2026-53067

Immediate Actions Required

Apply the upstream Linux stable kernel updates that include the three referenced commits
Rebuild and redeploy any custom or vendor kernels that include the pci-ep-msi driver
Restrict access to PCI endpoint configuration interfaces to trusted administrative accounts only

Patch Information

The fix is applied via three upstream commits in the stable kernel tree. The patch clears epf->db_msg and epf->num_db on the MSI allocation failure path and returns -EBUSY when doorbells are already allocated. Refer to the stable kernel commit 175717cfc06c and the companion backports for affected branches.

Workarounds

Disable the PCI endpoint framework (CONFIG_PCI_ENDPOINT) in kernel builds where it is not required
Unload or block loading of EPF function drivers that exercise the doorbell allocation path
Limit physical and administrative access to systems exposing PCI endpoint controllers until patches are deployed

bash

# Verify kernel version and check for the fix
uname -r
# Disable PCI endpoint framework if not required (kernel rebuild)
# In kernel .config:
# CONFIG_PCI_ENDPOINT=n