The Linux kernel vfio driver had a vulnerability in the vfio_mig_get_next_state() function where the skip loop that walks through vfio_from_fsm_table[] failed to account for the ERROR sentinel state (VFIO_DEVICE_STATE_ERROR). Because state_flags_table[ERROR] is ~0U and vfio_from_fsm_table[ERROR][*] is ERROR, once the next_fsm variable becomes ERROR, the loop condition remains true and next_fsm never changes, causing an infinite loop. This infinite loop occurs on blocked transitions such as STOP_COPY -> PRE_COPY and STOP_COPY -> PRE_COPY_P2P, which pass the support check on precopy-capable devices but map to ERROR, resulting in the driver state mutex being held indefinitely. This can cause a system soft lockup and potentially a kernel panic if configured. The fix terminates the skip loop when the ERROR sentinel is detected, allowing the function to return -EINVAL and avoid the infinite loop.

The vulnerability can cause the Linux kernel to enter an infinite loop while holding a driver state mutex, leading to a system soft lockup. If the kernel is configured with softlockup_panic enabled, this condition can trigger a kernel panic, causing a denial of service. No information about remote code execution or privilege escalation is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid workloads or device configurations that trigger the blocked transitions in vfio_mig_get_next_state(). Monitor vendor channels for updates and apply the official fix once released.