Linux Kernel KVM NULL Pointer Dereference Vulnerability in Device Cleanup Process

A NULL pointer dereference vulnerability has been identified in the Linux kernel's KVM (Kernel-based Virtual Machine) module. This issue arises during the cleanup of KVM devices, specifically with Book3s's interrupt controller KVM devices, which use the 'release' callback instead of the 'destroy' callback. The error handling in 'kvm_ioctl_create_device()' incorrectly assumes that 'destroy' is always defined, leading to a NULL dereference. This vulnerability was discovered by Syzkaller.

Impact

Exploitation of this vulnerability leads to a NULL pointer dereference, causing a crash or undefined behavior in the KVM module.