CVE-2026-64042
Received Received - Intake

Linux Kernel VFIO PCI DMABUF BAR Access Validation Flaw

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's possible to access unreserved resources through the export. Add a check to the DMABUF-creation path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64042
EUVD
EUVD-2026-45615

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the vfio/pci subsystem where DMABUF exports may access BAR resources that were not properly reserved. BAR resources are requested at startup but may not always be confirmed as reserved. The issue allows access to these unreserved resources through DMABUF exports, potentially leading to unintended memory access.

Detection Guidance

This vulnerability affects the Linux kernel's vfio/pci subsystem where DMABUF exports may access unreserved BAR resources. Detection requires checking kernel logs and vfio driver behavior for DMABUF-related errors or warnings. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

This vulnerability could allow unauthorized access to system memory or hardware resources if exploited. It may lead to data leaks, privilege escalation, or system instability, depending on the attacker's goals and the system's configuration.

Compliance Impact

The vulnerability involves improper access to BAR resources through DMABUF exports in the Linux kernel, which could lead to unauthorized memory access. This may impact compliance with standards like GDPR or HIPAA by potentially exposing sensitive data or system resources if exploited.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the vfio/pci DMABUF BAR resource access issue. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64042. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart