CVE-2026-64473
Received Received - Intake

VFIO Debugfs Use-After-Free in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_dev() currently calls vfio_device_del() before vfio_device_debugfs_exit(), but device_del() releases devres. This can leave debugfs entries visible with stale inode private data while unregister waits for userspace references to drain. Remove the per-device debugfs tree before vfio_device_del(). The debugfs view is diagnostic only, so losing it at the start of unregister is preferable to preserving entries whose backing storage may already have been released. Complete the teardown by clearing the per-device debugfs root after removal. This matches the global debugfs root cleanup and prevents future users from mistaking a removed dentry for a live debugfs tree during the remainder of unregister.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64473
EUVD
EUVD-2026-48817

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a timing issue during the cleanup of VFIO device debugfs files. When a VFIO device is unregistered, the debugfs entries may remain visible with stale data even after the underlying storage is released. This happens because device_del() releases devres before debugfs cleanup occurs.

Detection Guidance

This vulnerability is specific to the Linux kernel's VFIO subsystem and does not have a direct network detection method. It involves debugfs entries remaining visible after device teardown. Check for stale VFIO debugfs entries using commands like ls -la /sys/kernel/debug/vfio/ or dmesg for kernel warnings during device unregistration.

Impact Analysis

The impact is limited to diagnostic visibility. Stale debugfs entries could mislead users or tools monitoring device state during unregister. The actual device functionality is unaffected as debugfs is read-only and diagnostic only.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor kernel logs for VFIO-related errors during device unregistration. If debugfs entries persist abnormally, consider rebooting the system to clear stale state.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64473. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart