CVE-2026-64475 vfio/pci: Release the VGA arbiter client on register_device() failure

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of what is now vfiopcicoreregisterdevice without introducing an unwind f...

CVE-2026-64475

CVE-2026-64475 concerns the Linux kernel VFIO PCI subsystem. The issue arises from a re-order in a Fixes sequence where vfio_pci_vga_init() was displaced as the last failure point inside vfio_pci_core_register_device(), without an unwind for the VGA arbiter registration. In current kernels this i...

CVE-2026-64476

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disableidled3 per device When disableidled3 was introduced in vfio-pci, it directly manipulated the device power state with pcisetpowerstate. There were no refcounts to maintain or balanced operations, we could...

CVE-2026-64474

The CVE-2026-64474 issue affects the Linux kernel VFIO path, specifically vfio_mig_get_next_state() which walks vfio_from_fsm_table[] and could spin forever when encountering an ERROR sentinel (STOP_COPY arcs to ERROR). The root cause was an unaccounted ERROR sentinel in the skip loop, allowing a...

CVE-2026-64474

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

EUVD-2026-48818

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

CVE-2026-64474 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

CVE-2026-64474 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

CVE-2026-64474

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

CVE-2026-64473 vfio: Remove device debugfs before releasing devres

In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfscreatedevmseqfile store a devres allocated debugfsdevmentry as inode private data. vfiounregistergroupdev currently calls...

CVE-2026-64473 vfio: Remove device debugfs before releasing devres

In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfscreatedevmseqfile store a devres allocated debugfsdevmentry as inode private data. vfiounregistergroupdev currently calls...

CVE-2026-64473

Summary (CVE-2026-64473) : In the Linux kernel, VFIO debugfs teardown was reordered to fix a use-after-free-like state where per-device debugfs entries could remain visible with stale inode data after unregister. The root cause was that vfio_unregister_group_dev() called vfio_device_del() before ...

CVE-2026-64473

In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfscreatedevmseqfile store a devres allocated debugfsdevmentry as inode private data. vfiounregistergroupdev currently calls...

EUVD-2026-48816

In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same...

CVE-2026-64472 vfio/mlx5: Fix racy bitfields and tighten struct layout

In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same...

CVE-2026-64472

The CVE-2026-64472 entries describe a Linux kernel fix for vfio/mlx5: a racy bitfield layout was tightened by splitting bitfields and moving certain flags to dedicated storage units. The root cause was non-atomic bitfield operations using read-modify-write patterns, which could lead to concurrent...

CVE-2026-64472

In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same...

Linux Distros Unpatched Vulnerability : CVE-2026-64473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfscreatedevmseqfile store a devres allocated debugfsdevmentry as...

Linux Distros Unpatched Vulnerability : CVE-2026-64474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states...

Linux Distros Unpatched Vulnerability : CVE-2026-64475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of...