Linux Kernel Double Free Vulnerability in UIO PCI Generic SVA

A double free vulnerability has been identified in the Linux kernel's UIO PCI Generic SVA implementation. The issue arises because the 'uio_pci_sva' function allocates memory for the 'uio_pci_sva_dev' structure using 'devm_kzalloc()' during the probe phase. However, it also calls 'kfree()' on this memory both when the probe encounters an error and during the device removal process. This explicit deallocation can lead to a double free situation, as 'devm_kzalloc()' allocations are automatically managed and freed when the device is detached. The vulnerability was discovered through static analysis and manual review, and has been addressed by removing the redundant 'kfree()' calls.

Impact

Exploitation of this vulnerability can lead to a double free condition, which may cause memory corruption and potentially allow for arbitrary code execution.

Remediation

Users can apply the latest patches from the Linux kernel stable tree to address this vulnerability.