{"api_version":"1","generated_at":"2026-07-24T01:16:51+00:00","cve":"CVE-2026-63907","urls":{"html":"https://cve.report/CVE-2026-63907","api":"https://cve.report/api/cve/CVE-2026-63907.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-63907","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-63907"},"summary":{"title":"uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nuio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory\n\nuio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in\nprobe(), but then calls kfree(udev) both on the probe() error path\n(label out_free) and again in remove().\n\nBecause devm_kzalloc() allocations are devres-managed and are freed\nautomatically when the device is detached (including after a failing\nprobe() and during driver unbind), the explicit kfree() can lead to a\ndouble free.\n\nIf probe() fails after devm_kzalloc(), the error path frees udev and\ndevres cleanup will free it again when the core unwinds the partially\nbound device. On normal driver removal, remove() frees udev and devres\nwill free it again when the device is detached.\n\nThis issue was identified by a static analysis tool I developed and\nconfirmed by manual review. Fix by removing the manual kfree() calls\nand dropping the now-unused label.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-07-19 16:17:08","updated_at":"2026-07-19 16:17:08"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/e344865bfca4eb37ed8d7ac5917226e49fcec7ce","name":"https://git.kernel.org/stable/c/e344865bfca4eb37ed8d7ac5917226e49fcec7ce","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f74c8696f14149d5e43cc28b015326a759c48f00","name":"https://git.kernel.org/stable/c/f74c8696f14149d5e43cc28b015326a759c48f00","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63907","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63907","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3397c3cd859a2c51962ad032dcf97961d42f9db2 e344865bfca4eb37ed8d7ac5917226e49fcec7ce git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3397c3cd859a2c51962ad032dcf97961d42f9db2 f74c8696f14149d5e43cc28b015326a759c48f00 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.19","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0.12 7.0.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"63907","cve":"CVE-2026-63907","epss":"0.001890000","percentile":"0.087840000","score_date":"2026-07-20","updated_at":"2026-07-21 00:13:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/uio/uio_pci_generic_sva.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e344865bfca4eb37ed8d7ac5917226e49fcec7ce","status":"affected","version":"3397c3cd859a2c51962ad032dcf97961d42f9db2","versionType":"git"},{"lessThan":"f74c8696f14149d5e43cc28b015326a759c48f00","status":"affected","version":"3397c3cd859a2c51962ad032dcf97961d42f9db2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/uio/uio_pci_generic_sva.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nuio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory\n\nuio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in\nprobe(), but then calls kfree(udev) both on the probe() error path\n(label out_free) and again in remove().\n\nBecause devm_kzalloc() allocations are devres-managed and are freed\nautomatically when the device is detached (including after a failing\nprobe() and during driver unbind), the explicit kfree() can lead to a\ndouble free.\n\nIf probe() fails after devm_kzalloc(), the error path frees udev and\ndevres cleanup will free it again when the core unwinds the partially\nbound device. On normal driver removal, remove() frees udev and devres\nwill free it again when the device is detached.\n\nThis issue was identified by a static analysis tool I developed and\nconfirmed by manual review. Fix by removing the manual kfree() calls\nand dropping the now-unused label."}],"providerMetadata":{"dateUpdated":"2026-07-19T14:55:13.652Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e344865bfca4eb37ed8d7ac5917226e49fcec7ce"},{"url":"https://git.kernel.org/stable/c/f74c8696f14149d5e43cc28b015326a759c48f00"}],"title":"uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-63907","datePublished":"2026-07-19T14:55:13.652Z","dateReserved":"2026-07-19T07:54:57.020Z","dateUpdated":"2026-07-19T14:55:13.652Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-19 16:17:08","lastModifiedDate":"2026-07-19 16:17:08","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"63907","Ordinal":"1","Title":"uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memo","CVE":"CVE-2026-63907","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"63907","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nuio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory\n\nuio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in\nprobe(), but then calls kfree(udev) both on the probe() error path\n(label out_free) and again in remove().\n\nBecause devm_kzalloc() allocations are devres-managed and are freed\nautomatically when the device is detached (including after a failing\nprobe() and during driver unbind), the explicit kfree() can lead to a\ndouble free.\n\nIf probe() fails after devm_kzalloc(), the error path frees udev and\ndevres cleanup will free it again when the core unwinds the partially\nbound device. On normal driver removal, remove() frees udev and devres\nwill free it again when the device is detached.\n\nThis issue was identified by a static analysis tool I developed and\nconfirmed by manual review. Fix by removing the manual kfree() calls\nand dropping the now-unused label.","Type":"Description","Title":"uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memo"}]}}}