CVE-2026-64460

Received Received - Intake

PCI/IOV Array Index Out of Bounds in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-07-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[], which has only PCI_SRIOV_NUM_BARS (6) entries. When a device does not respond, config reads typically return PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN reports this as: UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]' Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding during a failed GC6 power state exit. The subsequent pci_restore_state() invoked sriov_restore_vf_rebar_state() while config reads returned 0xffffffff, triggering the splat. Bail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE. No further VF BARs are touched, which is safe because a config read that returns PCI_ERROR_RESPONSE indicates the device is unreachable and restoration is pointless. This mirrors the guard in pci_restore_rebar_state().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-07-27

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64460

EUVD

EUVD-2026-48804

Affected Vendors & Products

Vendor	Product	Version / Range
nvidia	rtx_pro_1000_gpu	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a function called sriov_restore_vf_rebar_state() fails to handle errors properly when reading device configuration registers. When a device stops responding, the function incorrectly calculates array indices using error values, causing an out-of-bounds memory access. This triggers a kernel error report (UBSAN) and could lead to system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel and involves an out-of-bounds array access in the PCI/IOV subsystem. Detection requires checking kernel logs for UBSAN errors related to array-index-out-of-bounds in drivers/pci/iov.c. Monitor logs with commands like dmesg | grep -i 'UBSAN' or journalctl -k | grep -i 'array-index-out-of-bounds'.

Impact Analysis

If your system uses an affected NVIDIA RTX PRO 1000 GPU and encounters a device failure, this vulnerability could cause kernel errors or crashes during device restoration. It may lead to system instability or require a reboot to recover normal operation.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it is a low-level Linux kernel issue affecting PCI/IOV functionality. Compliance risks would only arise if exploitation led to unauthorized data access or system disruption, which is not indicated in the provided context.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If using a vulnerable kernel version, avoid using SR-IOV features on affected NVIDIA GPUs. Monitor system logs for errors indicating device unresponsiveness during power state transitions.

Hi! I’m here to help you understand CVE-2026-64460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70