CVE-2026-93827

In the Linux kernel, the following vulnerability has been resolved:

virtio-fs: avoid double-free on failed queue setup

virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling

virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both

pointers and returns an error to virtio_fs_probe().

virtio_fs_probe() then drops the last kobject reference, and

virtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves

dangling pointers in struct virtio_fs and can trigger a double-free during

probe failure cleanup.

Set fs->vqs and fs->mq_map to NULL immediately after kfree() in the

virtio_fs_setup_vqs() error path so that the later kobject release sees an

uninitialized state and kfree(NULL) becomes harmless.

This can be reproduced when a broken virtio-fs device advertises more

request queues than the transport actually provides. In that case

virtio_find_vqs() fails while setting up the extra queue, and the probe

path reaches the double-free cleanup sequence.