Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-64475

vfio/pci: Release the VGA arbiter client on register_device() failure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration. In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could leave a callback with a freed vdev cookie. The stale registration also becomes unsafe again once the callback follows drvdata to the vfio device. Add the required VGA unwind callout.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 87856f9af04eaacf9848710625a4ffee1d020fa9 to < 0f2a35a0c7ea7da347b814750eaa78adf3582381affected
  • 4aeec3984ddc853f7c65903bde472ffdef738bae to < 8d65decde9afd2bd78bcfffdc0df73b82a0b5509affected
  • 4aeec3984ddc853f7c65903bde472ffdef738bae to < ef4c38d30b3744e89eb5048218904bb629ea8d47affected
  • 4aeec3984ddc853f7c65903bde472ffdef738bae to < 9e0a3f642e607848669235f5069f35640abbfc88affected
  • 4aeec3984ddc853f7c65903bde472ffdef738bae to < 42d758a09d2c46c42357ecde9a5492f015bde2e5affected
  • 4aeec3984ddc853f7c65903bde472ffdef738bae to < 52adb2dff7ce3d8430e2bdc5988b618a430def85affected
  • 4aeec3984ddc853f7c65903bde472ffdef738bae to < 278a5659c391fe5afe5f9ce1bad1fd24e90144f1affected
  • 4aeec3984ddc853f7c65903bde472ffdef738bae to < daedde7f024ecf88bc8e832ed40cf2c795f0796aaffected
  • d62dccb417cf972c978bf3c68a7d5e846bcf953eaffected
  • 6694b8daffac5a8661071f085608afc78f7acd08affected
  • 5.10.37 to < 5.10.261affected
  • 5.11.21 to < 5.12affected
  • 5.12.4 to < 5.13affected

Linux Linux

Default version status: affected

  • 5.13affected
  • 0 to < 5.13unaffected
  • 5.10.261 to ≤ 5.10.*unaffected
  • 5.15.212 to ≤ 5.15.*unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.96 to ≤ 6.12.*unaffected
  • 6.18.39 to ≤ 6.18.*unaffected
  • 7.1.4 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References