CVE-2026-63907 Overview
CVE-2026-63907 is a double free vulnerability in the Linux kernel's uio_pci_generic_sva driver. The driver allocates struct uio_pci_sva_dev using devm_kzalloc() in probe(), but then calls kfree(udev) on both the probe error path and in remove(). Because devm_kzalloc() allocations are managed by the device resource (devres) framework, the memory is freed automatically when the device is detached. The explicit kfree() results in a double free of the same allocation.
Critical Impact
Double free of devres-managed memory can corrupt kernel heap metadata, leading to potential memory corruption or denial of service on systems using the affected UIO PCI SVA driver.
Affected Products
- Linux kernel versions containing the uio_pci_generic_sva driver prior to the fix
- Distributions shipping the affected uio subsystem code
- Systems using UIO PCI shared virtual addressing (SVA) functionality
Discovery Timeline
- 2026-07-19 - CVE-2026-63907 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63907
Vulnerability Analysis
The vulnerability resides in the uio_pci_generic_sva driver in the Linux kernel's Userspace I/O (UIO) subsystem. The probe() function allocates a struct uio_pci_sva_dev object named udev using devm_kzalloc(). This allocation is tracked by the devres framework and is automatically released when the device is detached from the driver.
However, the driver code incorrectly performs an additional manual kfree(udev) in two locations: the out_free error label within probe(), and inside remove(). When probe() fails after devm_kzalloc() succeeds, the error path frees udev explicitly, and devres cleanup subsequently frees the same pointer during unwinding of the partially bound device. On normal driver removal, remove() frees udev before devres releases it a second time during device detachment.
A static analysis tool identified the issue, and manual review confirmed the double free pattern [CWE-415].
Root Cause
The root cause is a mismatch between the memory management model used at allocation and at deallocation. devm_kzalloc() returns devres-tracked memory that must not be freed manually. Introducing explicit kfree() calls alongside the devres registration breaks the invariant that devres-managed allocations have a single ownership path.
Attack Vector
Exploitation requires the affected uio_pci_generic_sva driver to be loaded and bound to a PCI device that supports SVA. Triggering the double free requires either a probe() failure after the devm_kzalloc() call succeeds, or normal driver unbind/remove flow. A local attacker with the ability to trigger device unbind operations or induce probe failures could reach the vulnerable code path. The impact depends on subsequent heap state and allocator behavior at the time of the second free.
No verified public exploit code is available. Refer to the upstream kernel commit for the exact patch removing the manual kfree() calls and the unused out_free label.
Detection Methods for CVE-2026-63907
Indicators of Compromise
- Kernel oops or panic messages referencing uio_pci_generic_sva, kfree(), or slab allocator corruption warnings
- SLUB: double free or KASAN: double-free reports in dmesg involving uio_pci_sva_dev allocations
- Unexpected system instability or crashes during PCI device probe failures or driver unbind operations
Detection Strategies
- Enable CONFIG_SLUB_DEBUG and CONFIG_KASAN in test environments to surface double free conditions early
- Audit loaded kernel modules for the presence of uio_pci_generic_sva on systems running vulnerable kernel versions
- Correlate kernel crash telemetry with events involving /sys/bus/pci/drivers/uio_pci_generic_sva/unbind writes
Monitoring Recommendations
- Collect and centrally analyze dmesg output for slab corruption warnings across the Linux fleet
- Alert on repeated kernel oops signatures pointing to the UIO subsystem
- Track kernel version and patch level inventory to identify hosts still exposed to the flaw
How to Mitigate CVE-2026-63907
Immediate Actions Required
- Apply the upstream Linux kernel patch that removes the manual kfree(udev) calls from uio_pci_generic_sva
- Update to a distribution kernel that includes the fix from stable commits e344865bfca4 and f74c8696f141
- Restrict access to PCI driver bind and unbind sysfs entries to privileged users only
Patch Information
The fix is available in the mainline and stable Linux kernel trees. Reference commits: e344865bfca4eb37ed8d7ac5917226e49fcec7ce and f74c8696f14149d5e43cc28b015326a759c48f00. The patch removes the redundant kfree() calls and drops the now-unused out_free label, relying entirely on devres to release the devm_kzalloc() allocation.
Workarounds
- Unload the uio_pci_generic_sva module on systems where the driver is not required using modprobe -r uio_pci_generic_sva
- Blacklist the module in /etc/modprobe.d/ to prevent automatic loading until the kernel is patched
- Limit local user privileges to reduce the risk of attacker-triggered driver unbind or probe operations
# Blacklist the vulnerable driver until the kernel is patched
echo 'blacklist uio_pci_generic_sva' | sudo tee /etc/modprobe.d/blacklist-uio-pci-sva.conf
sudo modprobe -r uio_pci_generic_sva
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
