CVE-2026-64042: Linux Kernel Privilege Escalation Flaw

CVE-2026-64042 Overview

CVE-2026-64042 is a Linux kernel vulnerability in the vfio/pci subsystem. The flaw allows local users with access to a vfio device to export a DMABUF (Direct Memory Access Buffer) that references PCI Base Address Register (BAR) resources without confirming those resources were actually reserved. An attacker can gain access to unreserved memory-mapped I/O regions through the exported DMABUF, breaching the isolation boundaries that VFIO (Virtual Function I/O) enforces for userspace device passthrough.

The issue was resolved upstream by adding a resource reservation check to the DMABUF creation path in the vfio/pci driver.

Critical Impact
Local attackers with vfio access can read from or write to PCI BAR regions that were never reserved for the guest or userspace consumer, breaking device isolation and exposing kernel-managed hardware resources.

Affected Products

Linux kernel builds containing the vfio/pci DMABUF export code path prior to commits 702809d and 8443cd4
Distributions shipping upstream stable kernels that had not yet backported the fix at publication time
Virtualization hosts using VFIO for PCI device passthrough to virtual machines or userspace drivers

Discovery Timeline

2026-07-19 - CVE-2026-64042 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64042

Vulnerability Analysis

The vfio/pci driver exposes PCI devices to userspace by mapping BAR regions and mediating DMA. To support zero-copy sharing with other subsystems such as GPUs, the driver can wrap BAR ranges in a DMABUF handle that other kernel components or userspace clients import.

BAR resources are requested when the vfio device is bound at startup, but the DMABUF export path did not re-verify that each requested BAR range had actually been reserved. When a region was not successfully reserved, exporting a DMABUF over that range produced a handle that referenced memory the driver had no exclusive claim over. Consumers importing that DMABUF could then reach physical MMIO addresses outside the intended device scope.

Because the fault is a missing precondition check rather than a corruption primitive, it does not depend on race timing or memory shape. Any code path that can request a DMABUF from a misconfigured vfio device triggers the exposure.

Root Cause

The DMABUF creation routine in vfio/pci trusted that BAR reservation at probe time implied a valid, reserved resource at export time. It did not consult pci_resource_flags() or equivalent state to confirm the region was in the IORESOURCE_BUSY state before handing out a mapping. The upstream fix, applied in commits 702809d and 8443cd4, adds an explicit reservation check to the DMABUF creation path and refuses the export if the resource is not reserved.

Attack Vector

Exploitation requires local access with permission to open a /dev/vfio/* device node and issue the DMABUF export ioctl. A user in a group granted vfio access, a container with the vfio device passed through, or a compromised userspace VMM (Virtual Machine Monitor) meets this requirement. No user interaction is needed. The scope change in the CVSS vector reflects that a successful export crosses from the vfio driver's control domain into other kernel or device contexts that consume the DMABUF.

No verified public proof-of-concept code is available. Refer to the upstream commits for the precise code path and fix.

Detection Methods for CVE-2026-64042

Indicators of Compromise

Unexpected DMABUF export ioctls issued against /dev/vfio/* devices from processes that are not the authorized VMM (for example, not qemu-system-* or a known userspace driver).
Kernel log entries from vfio-pci referencing BAR regions that were not successfully reserved at probe time, followed by successful DMABUF export activity.
Processes outside the virtualization stack opening vfio group file descriptors and holding them across long-lived sessions.

Detection Strategies

Audit openat and ioctl syscalls targeting /dev/vfio/ paths using auditd or eBPF-based sensors, and alert on issuers other than approved hypervisor binaries.
Correlate vfio-pci kernel messages about probe-time BAR reservation failures with subsequent DMABUF export activity from userspace.
Track membership changes to the vfio group and any capability grants (CAP_SYS_RAWIO, device cgroup allow rules) that widen access to vfio nodes.

Monitoring Recommendations

Ship kernel ring buffer and audit logs to a central store and retain vfio-related events for post-incident review.
Baseline the set of processes and users that legitimately interact with vfio device nodes on each host and alert on deviations.
Monitor kernel version and patch state across virtualization hosts to confirm the fix commits are present on running kernels.

How to Mitigate CVE-2026-64042

Immediate Actions Required

Update to a Linux kernel that includes commits 702809d and 8443cd4, or apply the distribution vendor's backported update.
Restrict membership in the vfio group and any device cgroup rules that expose /dev/vfio/* to only trusted virtualization services.
Reboot hosts after kernel updates so the fixed vfio-pci module is loaded.

Patch Information

The upstream fix adds a check to the DMABUF-creation path in the vfio/pci driver to confirm BAR resources were reserved before exporting. The patch is present in the stable kernel commits referenced above. Consult your Linux distribution's security tracker for the specific kernel package versions that carry the backport for your release.

Workarounds

Disable or unload the vfio-pci module on hosts that do not perform PCI passthrough: modprobe -r vfio_pci.
Remove non-essential users from the vfio group and revoke CAP_SYS_RAWIO from containers or services that do not require it.
On multi-tenant hosts, avoid binding devices to vfio-pci unless the guest workload requires direct BAR access, reducing the attack surface until patched kernels are deployed.

bash

# Verify the running kernel contains the fix commits
zgrep -E 'vfio.*DMABUF|vfio.*BAR' /proc/config.gz 2>/dev/null
uname -r

# Inspect current vfio device access and group membership
ls -l /dev/vfio/
getent group vfio

# Temporarily remove vfio-pci where passthrough is not in use
sudo modprobe -r vfio_pci