CVE-2026-64474
Received Received - Intake

Infinite Loop in Linux Kernel VFIO Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc vfio_mig_get_next_state() walks vfio_from_fsm_table[] one step at a time, looping to skip optional states the device does not support until *next_fsm is supported. A blocked transition is encoded as VFIO_DEVICE_STATE_ERROR, which the trailing return reports as -EINVAL. The skip loop does not account for the ERROR sentinel. state_flags_table[ERROR] is ~0U and vfio_from_fsm_table[ERROR][*] is ERROR, so once *next_fsm becomes ERROR the loop condition stays true and *next_fsm never changes. The blocked arcs STOP_COPY -> PRE_COPY and STOP_COPY -> PRE_COPY_P2P map to ERROR yet pass the support check on a precopy-capable device, causing the loop to spin forever while holding the driver state mutex. This can result in a soft lockup, and a panic with softlockup_panic set. Terminate the skip loop on the ERROR sentinel so a blocked transition falls through to the existing return and reports -EINVAL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64474
EUVD
EUVD-2026-48818

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the VFIO (Virtual Function I/O) subsystem. It involves an infinite loop in the function vfio_mig_get_next_state() when handling blocked state transitions. The loop fails to account for an error state (ERROR), causing it to spin indefinitely while holding a mutex. This can lead to a soft lockup or system panic if softlockup_panic is enabled.

Detection Guidance

This vulnerability is specific to the Linux kernel's VFIO driver and may cause a soft lockup or panic. Detection typically requires checking kernel logs for soft lockup warnings or system hangs related to VFIO operations. No direct commands are provided in the context, but monitoring for kernel panics or excessive CPU usage in VFIO-related processes may indicate exploitation.

Impact Analysis

The vulnerability can cause system instability by triggering a soft lockup or kernel panic. This may result in unresponsive systems, data corruption, or denial of service. Systems using VFIO for device passthrough, particularly in virtualization environments, are most affected.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If immediate patching is not possible, consider disabling VFIO functionality if not required, or restrict access to virtualization features. Monitor system logs for signs of exploitation or instability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64474. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart