In tipc_dev_probe of tipc_virtio_dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on probe failure due to a …

In tipc_dev_probe of tipc_virtio_dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on probe failure due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.