CVE-2026-90130 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
vdpa_sim: fix cleanup after worker creation failure
vdpasim_create() leaves vdpasim->worker as an ERR_PTR when kthread_run_worker() fails. The error path then drops the device reference, which releases the partially initialized simulator.
vdpasim_free() unconditionally passes the worker pointer to kthread_destroy_worker(), so the ERR_PTR is dereferenced and can trigger a general protection fault.
Store the worker error, clear the pointer, and only clean up the worker when it was successfully initialized. Also make the release path tolerate partially initialized objects by guarding virtqueue and IOTLB cleanup, since the same release path can be reached from other initialization failures.
I found this bug myself, though the patch was written with AI assistance.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Linux kernel involves a critical error handling flaw within the vDPA simulator driver, specifically during the device creation and subsequent cleanup phases. The core issue stems from improper management of thread worker resources when the initialization process fails partway through execution. When the function kthread_run_worker() encounters an error condition, it returns an ERR_PTR rather than NULL or a valid pointer. In this specific scenario, the vdpasim_create() function incorrectly assigns this erroneous return value directly to the vdpasim->worker field without checking for failure conditions first. This oversight leaves the device structure in an inconsistent state where it appears partially initialized but contains invalid pointers that are not suitable for standard operations.
The severity of this vulnerability is exacerbated by how the cleanup logic handles these partial initialization states. The release path, which includes calls to vdpasim_free(), assumes that if a worker pointer exists, it must be valid and safe to destroy. Consequently, when an error occurs during creation, the device reference count is dropped, triggering the free routine. This routine then unconditionally passes the ERR_PTR stored in the worker field to kthread_destroy_worker(). Since ERR_PTR values are encoded pointers representing negative error codes rather than actual memory addresses for kernel threads, dereferencing or passing them to functions expecting valid thread structures leads to a general protection fault. This results in a kernel panic or system crash, effectively creating a denial of service condition that can be triggered by local users who have the ability to interact with vDPA devices and induce initialization failures through resource exhaustion or other triggering mechanisms.
From a technical classification perspective, this flaw aligns closely with CWE-754: Improper Check for Unusual or Exceptional Conditions, as the code fails to validate the return value of kthread_run_worker() before proceeding. Furthermore, it relates to CWE-613: Insufficient Session Expiration because the cleanup logic does not properly account for objects that were never fully initialized, leading to use-after-free-like behavior where invalid pointers are treated as valid resources. In terms of attack vectors and techniques, this vulnerability can be mapped to MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under the sub-category of resource exhaustion or loop injection if an attacker can repeatedly trigger the failure condition. The lack of proper state management during initialization represents a fundamental flaw in defensive coding practices within kernel subsystems that handle hardware virtualization interfaces.
The operational impact of this vulnerability is significant for systems relying on vDPA devices, which are used to provide high-performance network and storage capabilities via virtio-based drivers. A successful exploitation leads to immediate system instability due to the general protection fault caused by dereferencing an invalid pointer in kernel space. This not only crashes the affected node but can also impact other virtual machines or containers running on the same host if they share critical resources, thereby compromising availability and potentially leading to data loss for active workloads. The bug highlights a common pitfall in Linux driver development where error paths are often less rigorously tested than success paths, leaving subtle race conditions or state inconsistencies that manifest only under specific failure scenarios.
To mitigate this vulnerability, the primary remediation involves correcting the initialization sequence within vdpasim_create(). Developers must explicitly check for errors returned by kthread_run_worker() and handle them appropriately before assigning values to structural fields. If a worker creation fails, the worker pointer should be cleared or set to NULL rather than left as an ERR_PTR. Additionally, the cleanup routine in vdpasim_free() must be updated to tolerate partially initialized objects. This means adding conditional checks to ensure that virtqueue and IOTLB cleanup operations are only performed if those components were successfully allocated during initialization. By guarding these release paths against null or invalid pointers, the driver ensures that even if early-stage failures occur, the system can safely unwind resources without dereferencing corrupted memory addresses. Applying kernel patches that implement these checks is essential for maintaining stability in environments utilizing vDPA-based virtualization technologies.