CVE-2026-64460 Overview
CVE-2026-64460 is an out-of-bounds array access vulnerability in the Linux kernel's PCI Single Root I/O Virtualization (SR-IOV) subsystem. The flaw resides in sriov_restore_vf_rebar_state() within drivers/pci/iov.c, which reads the Virtual Function (VF) Resizable BAR Control register to determine how many VF Base Address Registers (BARs) to restore. When a device becomes unresponsive, configuration reads return PCI_ERROR_RESPONSE (~0), causing both nbars and bar_idx to evaluate to 7. This exceeds the six-entry dev->sriov->barsz[] array, triggering an out-of-bounds access flagged by the Undefined Behavior Sanitizer (UBSAN).
Critical Impact
An unresponsive PCIe device triggering pci_restore_state() can cause kernel out-of-bounds memory access, leading to system instability or denial of service on affected hosts.
Affected Products
- Linux kernel versions containing sriov_restore_vf_rebar_state() in drivers/pci/iov.c
- Systems with SR-IOV capable PCIe devices supporting VF Resizable BAR
- Reported reproduction on NVIDIA RTX PRO 1000 GPU (GB207GLM) during failed GC6 power state exit
Discovery Timeline
- 2026-07-25 - CVE-2026-64460 published to the National Vulnerability Database
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64460
Vulnerability Analysis
The defect is an out-of-bounds read in the Linux kernel's PCI SR-IOV BAR restoration path. The function sriov_restore_vf_rebar_state() iterates over VF Resizable BARs using values extracted from the VF Resizable BAR Control register. Two 3-bit fields, nbars (number of BARs) and bar_idx (BAR index), drive both the loop count and array indexing into dev->sriov->barsz[].
The backing array barsz[] is sized to PCI_SRIOV_NUM_BARS, which equals 6. When the PCIe device stops responding, configuration space reads return PCI_ERROR_RESPONSE (0xffffffff). Extracting the 3-bit fields from this all-ones value yields 7 for both nbars and bar_idx, exceeding the valid range of 0–5.
The kernel reports the defect through UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]'. Reproduction was observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding during a failed GC6 power state exit, after which pci_restore_state() invoked the vulnerable function.
Root Cause
The root cause is missing validation of configuration read results. The code assumes that values read from the VF Resizable BAR Control register are within valid bounds. It does not check for the sentinel value PCI_ERROR_RESPONSE that indicates the device is unreachable. The 3-bit fields naturally accommodate values 0–7, but the corresponding array holds only 6 elements.
Attack Vector
The attack vector is local and requires specific hardware conditions. Triggering the flaw requires a PCIe device with SR-IOV and Resizable BAR support to enter an unresponsive state during pci_restore_state(). This can occur through power management transitions such as a failed GC6 exit on a GPU. A local attacker with the ability to induce device power-state transitions or hardware faults could trigger the out-of-bounds access, resulting in undefined kernel behavior or denial of service.
The vulnerability is described in prose only; refer to the upstream kernel commits for exact source-level context. See the kernel commit for the corrective patch.
Detection Methods for CVE-2026-64460
Indicators of Compromise
- Kernel log entries containing UBSAN: array-index-out-of-bounds in drivers/pci/iov.c with index 7 and type resource_size_t [6]
- PCIe configuration read failures returning 0xffffffff correlated with pci_restore_state() invocations
- Device hang or unresponsive state events during power-management transitions such as GC6 exit on NVIDIA GPUs
Detection Strategies
- Monitor dmesg and /var/log/kern.log for UBSAN splats referencing sriov_restore_vf_rebar_state or drivers/pci/iov.c
- Correlate PCIe Advanced Error Reporting (AER) events with subsequent SR-IOV restoration failures
- Track device power-state transition failures on SR-IOV capable hardware
Monitoring Recommendations
- Forward kernel ring buffer and AER logs to a centralized logging platform for cross-host correlation
- Alert on repeated UBSAN messages from PCI subsystem paths, which may indicate faulty or degrading hardware
- Track kernel version inventory across fleet to prioritize patched hosts running SR-IOV workloads
How to Mitigate CVE-2026-64460
Immediate Actions Required
- Apply the upstream Linux kernel patches that add a guard for PCI_ERROR_RESPONSE in sriov_restore_vf_rebar_state() and rebuild or update affected kernels
- Identify hosts running SR-IOV workloads with Resizable BAR-capable devices and prioritize them for patching
- Investigate any hardware exhibiting repeated unresponsive states, as the underlying device fault is the trigger for this defect
Patch Information
The fix bails out of sriov_restore_vf_rebar_state() if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE. No further VF BARs are touched, mirroring the existing guard in pci_restore_rebar_state(). The corrective commits are available in the upstream kernel tree: commit 55fd485e66d0, commit b775246212504, and commit f34f1712229d.
Workarounds
- Where patching is not immediately feasible, avoid power-state transitions known to cause target devices to become unresponsive (for example, disable GC6 on affected NVIDIA GPUs)
- Disable SR-IOV on hosts running suspect hardware until the kernel patch can be deployed
- Replace or isolate hardware that has demonstrated repeated unresponsive states during PCIe configuration access
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
