CVE-2026-64475
Received Received - Intake

VFIO PCI VGA Arbiter Client Release Failure

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration. In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could leave a callback with a freed vdev cookie. The stale registration also becomes unsafe again once the callback follows drvdata to the vfio device. Add the required VGA unwind callout.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64475
EUVD
EUVD-2026-48819

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a failure to properly release the VGA arbiter client when the vfio_pci_core_register_device() function encounters an error. The issue arises because the VGA arbiter registration cleanup step was not included in the failure path, which could lead to a stale callback with a freed vdev cookie. This is unsafe as the callback might later access the freed vdev through drvdata.

Detection Guidance

This vulnerability is specific to the Linux kernel's VFIO PCI driver and does not have network-based detection methods. To check if your system is affected, verify the kernel version and whether the VFIO PCI driver is in use. Commands: uname -r to check kernel version, lsmod | grep vfio_pci to check if the driver is loaded.

Impact Analysis

This vulnerability could potentially allow unintended access to system resources or cause instability in systems using VFIO PCI devices. If exploited, it might lead to crashes, data corruption, or unauthorized access to graphics resources managed by the VGA arbiter.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Monitor vendor advisories for kernel updates and apply them promptly. If VFIO PCI is not required, consider unloading the module with rmmod vfio_pci.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64475. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart