CVE-2026-63907

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory<br /> <br /> uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in<br /> probe(), but then calls kfree(udev) both on the probe() error path<br /> (label out_free) and again in remove().<br /> <br /> Because devm_kzalloc() allocations are devres-managed and are freed<br /> automatically when the device is detached (including after a failing<br /> probe() and during driver unbind), the explicit kfree() can lead to a<br /> double free.<br /> <br /> If probe() fails after devm_kzalloc(), the error path frees udev and<br /> devres cleanup will free it again when the core unwinds the partially<br /> bound device. On normal driver removal, remove() frees udev and devres<br /> will free it again when the device is detached.<br /> <br /> This issue was identified by a static analysis tool I developed and<br /> confirmed by manual review. Fix by removing the manual kfree() calls<br /> and dropping the now-unused label.