vdpa_sim: fix cleanup after worker creation failure

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-90130
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-17 17:17:05 UTC
Updated2026-09-17 17:17:05 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: vdpa_sim: fix cleanup after worker creation failure vdpasim_create() leaves vdpasim->worker as an ERR_PTR when kthread_run_worker() fails. The error path then drops the device reference, which releases the partially initialized simulator. vdpasim_free() unconditionally passes the worker pointer to kthread_destroy_worker(), so the ERR_PTR is dereferenced and can trigger a general protection fault. Store the worker error, clear the pointer, and only clean up the worker when it was successfully initialized. Also make the release path tolerate partially initialized objects by guarding virtqueue and IOTLB cleanup, since the same release path can be reached from other initialization failures. I found this bug myself, though the patch was written with AI assistance.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 76acfa7bc54f1e3b9dde396e0a3534493419fd6f feafa109f031ed111f7f968e447c13985db498e0 git Not specified
CNA Linux Linux affected 76acfa7bc54f1e3b9dde396e0a3534493419fd6f 05ddc94afb69e36df59e88cfa9e5c7bf9d10cfd0 git Not specified
CNA Linux Linux affected 76acfa7bc54f1e3b9dde396e0a3534493419fd6f 68b726b3a01fb02a68843781b17d05ef3d759987 git Not specified
CNA Linux Linux affected 76acfa7bc54f1e3b9dde396e0a3534493419fd6f ca6f3fa599cb764518df595368b743f856fdb516 git Not specified
CNA Linux Linux affected 76acfa7bc54f1e3b9dde396e0a3534493419fd6f bd670e5dfd2b01fd9692f61fa1456434c54026a4 git Not specified
CNA Linux Linux affected 6.4 Not specified
CNA Linux Linux unaffected 6.4 semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.110 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.52 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.6 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/ca6f3fa599cb764518df595368b743f856fdb516 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/68b726b3a01fb02a68843781b17d05ef3d759987 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/bd670e5dfd2b01fd9692f61fa1456434c54026a4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/05ddc94afb69e36df59e88cfa9e5c7bf9d10cfd0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/feafa109f031ed111f7f968e447c13985db498e0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report