CVE-2026-97607

Executive Summary

CVE-2026-97607 is a resource-management defect in the Linux kernel vdpa subsystem's ifcvf driver. When the driver encounters an unsupported set of provisioned features, the error path taken after vdpa_alloc_device() fails to release the previously allocated device and adapter pointer, resulting in a leaked resource. Because the vulnerable code is reachable only through privileged configuration of a vDPA device backed by an Intel IFC (Intel FPGA SmartNIC) adapter, the practical attacker is a local user or administrator with control over device provisioning — the impact is a persistent kernel resource leak that can degrade or exhaust the vDPA device pool.

Technical Analysis

The vdpa subsystem provides a kernel-level framework for virtualizing data-path acceleration hardware. The ifcvf driver is the front-end for Intel IFC-family adapters. Device instantiation in this driver follows the pattern of first resolving and validating the feature set advertised by the hardware, then calling vdpa_alloc_device() to reserve the struct vdpa_device object and its associated adapter state.

The NVD description states that the fix routes "unsupported provisioned features through the common error path after vdpa_alloc_device() so the allocated device and adapter pointer are released consistently." This tells us precisely what the defect is: the validation of provisioned features occurs after the allocation call, and the branch that handles a validation failure does not return through the shared cleanup/error path. Consequently, when provisioning requests a feature combination the driver cannot support, the function returns an error to the caller without invoking vdpa_free_device() (or its equivalent cleanup) on the object that vdpa_alloc_device() already created, and without clearing the adapter pointer that references that object.

This is a classic missing-cleanup-on-error-path bug, mapped to CWE-772 (Missing Release of Resource after Effective Lifetime). There is no memory-safety violation described — no use-after-free, no out-of-bounds access, no uninitialized read. The objects remain allocated and referenced; they are simply never freed on this specific exit branch. The attacker does not directly control the leaked memory contents; the consequence is cumulative loss of kernel-managed device slots and associated structures.

The attack surface is the device-provisioning interface of the vdpa subsystem as exposed to a process authorized to manage vDPA devices (typically CAP_NET_ADMIN / CAP_SYS_ADMIN in the host or a privileged management plane). Because the trigger is a feature-negotiation value chosen by the caller rather than a raw packet, remote unauthenticated exploitation is not indicated by the description.

No public proof-of-concept, Nuclei template, or exploit code is known (POC_STATUS: None). No CVE record indicates CISA KEV inclusion. All statements in this section are derived strictly from the supplied NVD description; kernel-internal call sequences beyond the explicitly named vdpa_alloc_device() are described at the design-pattern level and are not asserted as verbatim source code.

Exploitation Scenarios

The attack chain for this vulnerability is inferred from the vulnerability class (resource leak on an error path), because no public PoC or exploit code exists.

1. Reconnaissance / target identification. The attacker determines whether the host exposes IFC-family vDPA hardware and whether the kernel's ifcvf module is loaded. This is observable from the local management context: presence of the IFC PCI device, the vdpa device class entries, and the loaded ifcvf module. In a cloud or multi-tenant virtualization host, this reconnaissance is performed by an operator or a process with control over device assignment rather than by an anonymous network client.

2. Triggering the flaw class. The attacker initiates device provisioning through the normal vDPA management interface while deliberately requesting a feature set that the ifcvf driver does not support. Because validation of provisioned features runs after vdpa_alloc_device(), the driver allocates the device and adapter state, then takes the unsupported-feature branch and returns an error without tearing the allocation down. No memory corruption occurs; the allocation is simply orphaned.

3. Payload / execution method. At the vulnerability-class level, the "payload" is the malformed or out-of-range feature-negotiation value supplied at provisioning time. The attacker must be able to issue provisioning requests repeatedly — a mismatch between requested and supported features is the only input that matters. Execution is therefore a control-plane operation, not a packet-delivery operation.

4. Post-exploitation impact. Repeated triggering leaks vdpa_device objects and their adapter pointers, monotonically growing kernel memory pressure and consuming the finite pool of vDPA device instances. Practical effects are denial-of-service-flavored: new vDPA devices can no longer be created, existing provisioning operations fail, and the host accrues unbounded kernel allocations until the affected subsystem (or the host) degrades. Under a local-only access model, this is best characterized as a privileged local denial of service against the virtualization data-plane management stack, not a confidentiality or integrity compromise.

Impact Assessment

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (CVSS base score not provided in the source data; the vector indicates local access, low complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact). Note that no official CVSS score is recorded for this CVE in the supplied data; the vector above reflects the flaw's local, privileged, availability-only character as described by NVD.

• Confidentiality (C:N): No data disclosure is described. The leaked structures are not returned to the caller.
• Integrity (I:N): No data corruption or unauthorized modification is described.
• Availability (A:H): This is the primary consequence. Unbounded resource leakage in a kernel subsystem can exhaust the vDPA device pool and drain kernel memory over repeated triggers.
• Blast radius: Hosts and hypervisors running IFC-family vDPA hardware with the ifcvf driver loaded, and any tenant or workload depending on vDPA-accelerated networking. Multi-tenant environments are the most exposed because repeated privileged provisioning attempts against the shared device pool affect all tenants on that host.
• Exploit prerequisites: High privileges (ability to manage vDPA devices) and local/management-plane access. No user interaction and no special race condition are implied.

Detection Guidance

Sigma Rule

title: Potential Linux vdpa ifcvf Unsupported Feature Error Trigger (CVE-2026-97607)
id: 7c2f1e94-3b64-4a1e-9f0d-2ab6c5d10f77
status: experimental
description: Detects repeated provisioning of vDPA devices that fail with unsupported-feature errors, consistent with triggering the ifcvf resource leak on the error path after vdpa_alloc_device().
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97607
author: valtersit.com
date: 2026/01/01
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  service: kernel
detection:
  selection_modprobe:
    type: 'SYSCALL'
    syscall: 'init_module'
    exe|endswith:
      - '/ifcvf'
  selection_vdpa_provision:
    type: 'SYSCALL'
    key|contains: 'vdpa'
  selection_err:
    message|contains:
      - 'unsupported provisioned features'
      - 'unsupported features'
      - 'ifcvf'
  condition: (selection_modprobe or selection_vdpa_provision) and selection_err
falsepositives:
  - Legitimate vDPA device management by an authorized hypervisor operator
  - Kernel probe/testing workloads
level: medium

YARA Rule

rule CVE_2026_97607_ifcvf_unsupported_feature_errorpath
{
    meta:
        description = "Detects kernel log strings associated with the ifcvf vDPA unsupported-feature error path (CVE-2026-97607)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97607"
        severity = "medium"

    strings:
        $ifcvf = "ifcvf" ascii wide nocase
        $vdpa  = "vdpa_alloc_device" ascii wide
        $err1  = "unsupported provisioned features" ascii wide nocase
        $err2  = "unsupported features" ascii wide nocase
        $err3  = "ifcvf: " ascii wide nocase

    condition:
        $ifcvf and (any of ($err*) or $vdpa)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-97607 Linux vdpa ifcvf unsupported feature provisioning attempt (control-plane heuristic)"; flow:to_server,established; content:"vdpa"; nocase; content:"ifcvf"; nocase; distance:0; within:256; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,CVE-2026-97607; sid:9760701; rev:1;)

Elastic Detection

sequence by process.pid with maxspan=2m
  [ process where event.type == "start" and process.name in ("vdpa", "ip") and
      process.args : "*vdpa*" ]
  [ file where event.type == "creation" or event.type == "access" and
      file.path : "*ifcvf*" ]
| filter event.category : ("driver" or "process")

(Note: vDPA provisioning is normally a local control-plane operation. Host-based telemetry is the primary detection surface; network rules above are heuristic and apply only where management traffic is proxied.)

Splunk SPL Query

index=linux (sourcetype=syslog OR sourcetype=kernel)
| search ("ifcvf" OR "vdpa") AND ("unsupported provisioned features" OR "unsupported features" OR "vdpa_alloc_device")
| stats count by host, process, message
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="linux,kernel,vulnerability,CVE-2026-97607,">
  <rule id="976071" level="7">
    <decoded_as>syslog</decoded_as>
    <match>ifcvf</match>
    <regex>unsupported provisioned features|unsupported features</regex>
    <description>CVE-2026-97607: Linux vdpa ifcvf unsupported feature error path triggered - possible resource leak/DoS</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>vulnerability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range has been confirmed from tracked sources. The description references a resolution commit in the upstream Linux kernel, but no distribution backport or advisory has been confirmed.

1. Immediate mitigations

   • Restrict the ability to provision or manage vDPA devices to fully trusted administrators; the flaw requires the ability to supply a provisioned feature set that the ifcvf driver rejects.
   • If the ifcvf driver is not required for any active workload, blacklist or do not load it to remove the attack surface.
   • Monitor kernel logs for repeated ifcvf unsupported-feature errors and correlate with privileged ip/vdpa invocations; repeated errors are the most reliable local indicator of triggering.
   • Where feasible, isolate IFC-backed vDPA workloads so a leaked device pool affects the smallest possible blast radius.

2. Patch/upgrade steps

   • Apply the upstream Linux kernel commit identified as 705318a99a138bce8c01d21e46c79d5e4e0a1f9c ("vdpa: ifcvf: Put device on unsupported feature error") or a kernel release that contains it.
   • Check downstream distribution advisories for a backported fix; confirm the ifcvf driver version actually shipped in the kernel package before assuming coverage.
   • Because patch confidence is 0/4, treat this as UNPATCHED until a kernel version containing the fix is confirmed in your environment.

3. Long-term hardening

   • Enforce least privilege on all device-management interfaces (vdpa, PCI assignment, module loading) and audit privileged provisioning activity.
   • Track kernel subsystem patches for vdpa/ifcvf and maintain a tested upgrade cadence.
   • Baseline kernel memory and vDPA device-pool utilization; alert on monotonic growth consistent with an unreturned resource on an error path.
   • Treat local privileged denial-of-service on hypervisor control planes as an availability risk in multi-tenant architectures and include it in host integrity monitoring.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97607
• Linux kernel commit (fix): 705318a99a138bce8c01d21e46c79d5e4e0a1f9c — "vdpa: ifcvf: Put device on unsupported feature error"
• Upstream Linux kernel vdpa/ifcvf driver source (for patch verification)
• FIRST EPSS: not yet scored (no EPSS value available)
• CISA KEV: not listed (no known exploited vulnerability status)

No known threat actor campaigns or exploit-in-the-wild evidence exist for CVE-2026-97607 based on the supplied data. No public PoC, Nuclei template, or exploit code is available; the exploitation scenarios above are inferred from the vulnerability class (resource leak on an error path) and are clearly labeled as such.