CVE-2026-64475

Awaiting Analysis Awaiting Analysis - Queue

VFIO PCI VGA Arbiter Client Release Failure

Publication date: 2026-07-25

Last updated on: 2026-11-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration. In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could leave a callback with a freed vdev cookie. The stale registration also becomes unsafe again once the callback follows drvdata to the vfio device. Add the required VGA unwind callout.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-11-03

Generated

2026-11-08

AI Q&A

2026-07-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-64475

EUVD

EUVD-2026-48819

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a failure to properly release the VGA arbiter client when the vfio_pci_core_register_device() function encounters an error. The issue arises because the VGA arbiter registration cleanup step was not included in the failure path, which could lead to a stale callback with a freed vdev cookie. This is unsafe as the callback might later access the freed vdev through drvdata.

Detection Guidance

This vulnerability is specific to the Linux kernel's VFIO PCI driver and does not have network-based detection methods. To check if your system is affected, verify the kernel version and whether the VFIO PCI driver is in use. Commands: uname -r to check kernel version, lsmod | grep vfio_pci to check if the driver is loaded.

Impact Analysis

This vulnerability could potentially allow unintended access to system resources or cause instability in systems using VFIO PCI devices. If exploited, it might lead to crashes, data corruption, or unauthorized access to graphics resources managed by the VGA arbiter.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a low-level Linux kernel driver issue (vfio/pci) without clear implications for data protection or privacy controls.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Monitor vendor advisories for kernel updates and apply them promptly. If VFIO PCI is not required, consider unloading the module with rmmod vfio_pci.

Hi! I’m here to help you understand CVE-2026-64475. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...