CVE-2026-64475vfio/pci: Release the VGA arbiter client on register_device() failure
- 8.8HighCVSS base score
- 0.14%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration. In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could leave a callback with a freed vdev cookie. The stale registration also becomes unsafe again once the callback follows drvdata to the vfio device. Add the required VGA unwind callout.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.14% · top 97% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
- affected 87856f9af04eaacf9848710625a4ffee1d020fa9 – < 0f2a35a0c7ea7da347b814750eaa78adf3582381
- affected 4aeec3984ddc853f7c65903bde472ffdef738bae – < 8d65decde9afd2bd78bcfffdc0df73b82a0b5509
- affected 4aeec3984ddc853f7c65903bde472ffdef738bae – < ef4c38d30b3744e89eb5048218904bb629ea8d47
- affected 4aeec3984ddc853f7c65903bde472ffdef738bae – < 9e0a3f642e607848669235f5069f35640abbfc88
- affected 4aeec3984ddc853f7c65903bde472ffdef738bae – < 42d758a09d2c46c42357ecde9a5492f015bde2e5
- affected 4aeec3984ddc853f7c65903bde472ffdef738bae – < 52adb2dff7ce3d8430e2bdc5988b618a430def85
- affected 4aeec3984ddc853f7c65903bde472ffdef738bae – < 278a5659c391fe5afe5f9ce1bad1fd24e90144f1
- affected 4aeec3984ddc853f7c65903bde472ffdef738bae – < daedde7f024ecf88bc8e832ed40cf2c795f0796a
- affected d62dccb417cf972c978bf3c68a7d5e846bcf953e
- affected 6694b8daffac5a8661071f085608afc78f7acd08
- affected 5.10.37 – < 5.10.261
- affected 5.11.21 – < 5.12
- affected 5.12.4 – < 5.13
- affected 5.13
- unaffected < 5.13
- unaffected 5.10.261 – ≤ 5.10.*
- unaffected 5.15.212 – ≤ 5.15.*
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.96 – ≤ 6.12.*
- unaffected 6.18.39 – ≤ 6.18.*
- unaffected 7.1.4 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/0f2a35a0c7ea7da347b814750eaa78adf3582381 (opens in a new tab)
- https://git.kernel.org/stable/c/8d65decde9afd2bd78bcfffdc0df73b82a0b5509 (opens in a new tab)
- https://git.kernel.org/stable/c/ef4c38d30b3744e89eb5048218904bb629ea8d47 (opens in a new tab)
- https://git.kernel.org/stable/c/9e0a3f642e607848669235f5069f35640abbfc88 (opens in a new tab)
- https://git.kernel.org/stable/c/42d758a09d2c46c42357ecde9a5492f015bde2e5 (opens in a new tab)
- https://git.kernel.org/stable/c/52adb2dff7ce3d8430e2bdc5988b618a430def85 (opens in a new tab)
- https://git.kernel.org/stable/c/278a5659c391fe5afe5f9ce1bad1fd24e90144f1 (opens in a new tab)
- https://git.kernel.org/stable/c/daedde7f024ecf88bc8e832ed40cf2c795f0796a (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-48819 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-64475)Record last updated .