CVE-2026-53067: Linux Kernel PCI Endpoint MSI Double-Free Memory Vulnerability

Technical summary

CVE-2026-53067 is a double-free and use-after-free vulnerability in the Linux kernel's PCI endpoint MSI implementation (pci-epf-alloc-doorbell function). The vulnerable code allocates a doorbell message array and stores pointers in epf->db_msg and epf->num_db, then requests MSI vectors. If MSI allocation fails, the array is freed but the EPF (Endpoint Function) data structure retains the old pointers. This creates two failure modes: (1) a subsequent cleanup or retry attempt may double-free the already-freed array, and (2) callers unaware of the allocation failure may attempt to use stale memory references. Additionally, the function lacks a guard against re-allocation attempts on already-allocated doorbells, enabling resource exhaustion or state corruption. The fix requires clearing the EPF pointers on MSI failure and returning -EBUSY on repeated allocation attempts.

Business impact

This vulnerability affects systems running vulnerable Linux kernels with PCI endpoint functionality enabled, particularly embedded devices, IoT appliances, and specialized hardware platforms that use kernel-level PCI endpoint drivers. A local attacker (user-space process on the same system) can trigger the flaw to cause kernel crashes, escalate privileges, or potentially execute arbitrary code in kernel context. Organizations relying on PCI endpoint functionality for device firmware updates, device-to-device communication, or specialized I/O operations face service interruption or compromise risks until patching is applied.

Affected systems

The Linux kernel is affected, specifically the PCI endpoint MSI module. Exposure is limited to systems where PCI endpoint functionality is compiled and enabled in the kernel. This includes custom embedded Linux builds, IoT devices, automotive systems, and industrial equipment that use PCI endpoint drivers for inter-device communication or firmware provisioning. Standard desktop and server deployments with PCI endpoint disabled are not at risk. Organizations should audit their kernel configurations to determine if CONFIG_PCI_ENDPOINT or related modules are active.

Exploitability

Exploitability is moderate. The vulnerability requires local access (a user-space process or privileged code path on the system) and low privilege levels to trigger. The flaw does not require special userland tools—it can be triggered through normal system calls and device I/O operations targeting the PCI endpoint driver. An attacker with shell access or an unprivileged application capable of accessing PCI endpoint sysfs/ioctl interfaces can reliably reproduce the condition. However, successful exploitation to achieve code execution depends on kernel address space layout randomization (ASLR) and other mitigations, making reliable exploitation more difficult but not infeasible for a motivated attacker. Denial of service via kernel crash is straightforward.

Remediation

Apply kernel patches that implement proper cleanup of epf->db_msg and epf->num_db on MSI allocation failure, and add a guard to prevent re-allocation when doorbells are already allocated. Monitor Linux kernel security advisories and upstream git commits for this CVE. Verify patch availability from your Linux distribution (Red Hat, Canonical, SUSE, etc.). As an interim mitigation, disable PCI endpoint functionality if it is not required (compile kernel without CONFIG_PCI_ENDPOINT or remove the module).

Patch guidance

Consult the Linux kernel upstream repository and your distribution's security advisories for the specific patch version. Patches will be integrated into stable kernel releases following the CVE announcement. Verify the patch against the vendor advisory to confirm the fix addresses both the double-free on MSI failure and the re-allocation guard. Test patched kernels in a non-production environment before broad deployment, particularly on systems where PCI endpoint is actively used. Organizations using long-term support (LTS) kernels should prioritize updates, as LTS versions may take longer to receive patches.

Detection guidance

Monitor kernel logs for oops, panic, or memory corruption warnings involving the pci-epf or pci_ep_msi modules. Use kernel debugging tools (kgdb, kdump) to capture crash dumps if the system experiences sudden resets or hangs related to PCI endpoint operations. In user space, monitor for processes repeatedly opening or closing PCI endpoint device files or sysfs interfaces, which may indicate exploitation attempts. Intrusion detection systems (IDS) should flag repeated failed device I/O operations on /sys/class/pci_ep or /dev/pci_ep* nodes. If KASAN (Kernel Address Sanitizer) is enabled, it will detect double-free and use-after-free conditions on affected systems.

Why prioritize this

This vulnerability warrants HIGH priority patching because it affects kernel memory safety, allows local privilege escalation, and impacts systems where PCI endpoint functionality is in active use. The CVSS 7.8 score reflects the severity: local attack vector, low privilege requirement, and high impact across confidentiality, integrity, and availability. While exploitation requires local access and is not as immediately critical as a remote unauthenticated flaw, the kernel-level nature of the vulnerability and the potential for code execution make swift remediation essential for any organization deploying vulnerable kernel versions on systems with PCI endpoint enabled.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) is justified by: (1) Attack Vector: Local—requires presence on the system, but not remote; (2) Attack Complexity: Low—no special conditions needed to trigger the flaw; (3) Privileges Required: Low—standard user-space process can trigger it; (4) User Interaction: None; (5) Impact: High across all three dimensions—confidentiality (kernel memory disclosure), integrity (memory corruption leading to code execution), and availability (kernel crash). The score does not account for ASLR or other runtime mitigations that may reduce exploitability in practice, but assumes a worst-case scenario where an attacker can reliably achieve kernel-level impact.

Frequently asked questions