Description

In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy target device if coalesced MMIO unregistration fails Destroy and free the target coalesced MMIO device if unregistering said device fails. As clearly noted in the code, kvm_io_bus_unregister_dev() does not destroy the target device. BUG: memory leak unreferenced object 0xffff888112a54880 (size 64): comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s) hex dump (first 32 bytes): 38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff 8.g.....8.g..... e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff .........0g..... backtrace: [] kmalloc include/linux/slab.h:556 [inline] [] kzalloc include/linux/slab.h:690 [inline] [] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150 [] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323 [] vfs_ioctl fs/ioctl.c:46 [inline] [] file_ioctl fs/ioctl.c:509 [inline] [] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696 [] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713 [] __do_sys_ioctl fs/ioctl.c:720 [inline] [] __se_sys_ioctl fs/ioctl.c:718 [inline] [] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718 [] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290 [] entry_SYSCALL_64_after_hwframe+0x49/0xbe BUG: leak checking failed

Severity Unknown

CVSS Score N/A

CVSS Vector N/A

CWE N/A

Public Exploit ✅ No

Source NVD

Published 2025-12-24

Updated 2026-06-08

Modified 2026-04-02

Fix URL N/A

Software	From version	Fixed in
kernel	5.16.0	6.2.3
unknown	—	—