CVE-2026-64472: Linux Kernel Race Condition Vulnerability

CVE-2026-64472 Overview

CVE-2026-64472 is a race condition vulnerability in the Linux kernel's vfio/mlx5 driver. The flaw stems from packing multiple bitfields that can be concurrently updated into the same storage unit. Because bitfield operations are not atomic and rely on a read-modify-write pattern, concurrent updates from independent execution contexts can corrupt neighboring bits within the same word.

The affected driver handles virtual function I/O for Mellanox ConnectX devices, including live migration state and dirty page tracking. Concurrent updates from probe, runtime attach/detach, page tracker start/stop, and PCI error recovery paths can race on the same storage unit.

Critical Impact
Concurrent writes to packed bitfields in the mlx5_vf_migration_file structure can produce inconsistent driver state affecting migration, dirty tracking, and error recovery on Mellanox VFIO devices.

Affected Products

Linux kernel builds that include the vfio/mlx5 driver
Systems using Mellanox ConnectX virtual functions with VFIO passthrough
Hosts performing SR-IOV live migration or dirty page tracking with mlx5 devices

Discovery Timeline

2026-07-25 - CVE-2026-64472 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64472

Vulnerability Analysis

The vfio/mlx5 driver stored multiple state flags as bitfields inside a single storage unit within its per-device structure. Compilers implement bitfield writes as read-modify-write sequences on the containing word. When two threads update different bitfields that share a word, one write can overwrite the other's change, corrupting driver state.

The upstream fix separates flags by concurrency profile. Fields written only at probe time remain packed together as bitfields: migrate_cap, chunk_mode, and mig_state_cap, all set exclusively in mlx5vf_cmd_set_migratable(). Fields written at runtime were promoted to dedicated storage units so their updates cannot race across bitfield boundaries.

The runtime-mutated fields include mdev_detach (updated by the VF attach/detach event notifier mlx5fv_vf_event()), log_active (updated by mlx5vf_start_page_tracker() and mlx5vf_stop_page_tracker()), deferred_reset (updated during PCI AER reset handling in mlx5vf_pci_aer_reset_done()), is_err (set by tracker error handling and dirty-log polling), and object_changed (set by tracker event handling, cleared by dirty-log polling). The mlx5_vhca_page_tracker.status field is relocated to fill the alignment hole this split introduces.

Root Cause

The root cause is a non-atomic read-modify-write on shared storage. C bitfields declared within the same storage unit are updated through a full-word load, mask, and store. Without explicit locking or dedicated storage, two CPUs writing separate flag bits in that word can lose one update. This is a classic atomicity violation between concurrently mutated flags.

Attack Vector

Triggering the race requires operations on a VFIO-bound mlx5 virtual function that reach the affected code paths concurrently. Contributing paths include a device reset via PCI AER recovery, VF attach/detach notifications, dirty page tracker start/stop from userspace, and tracker error or polling events. Consistent triggering requires local privileges sufficient to control VFIO device state and induce reset or tracker events on the target device.

The vulnerability manifests as corrupted flag state. See the upstream commits linked below for the exact structure layout and the applied fix.

Detection Methods for CVE-2026-64472

Indicators of Compromise

Unexpected vfio-pci or mlx5 kernel log entries referencing inconsistent migration state, dirty tracker failures, or AER reset anomalies on ConnectX virtual functions
Failed or hung live migration operations for SR-IOV VFs backed by mlx5 hardware
Repeated tracker error events (is_err set) coincident with device reset activity

Detection Strategies

Inventory kernel versions across virtualization hosts and identify systems running unpatched vfio/mlx5 code
Correlate dmesg and journald records for mlx5 tracker or migration errors during periods of reset or VF churn
Monitor VFIO ioctl activity on hosts where untrusted or multi-tenant workloads can bind mlx5 VFs

Monitoring Recommendations

Ship kernel and hypervisor logs to a central SIEM and alert on mlx5 tracker errors, VFIO reset events, and unexpected migration failures
Track running kernel versions as a configuration item and flag hosts that deviate from the patched baseline
Baseline normal frequency of AER resets on mlx5 devices and alert on statistically significant spikes

How to Mitigate CVE-2026-64472

Immediate Actions Required

Apply the upstream kernel patches referenced below or upgrade to a distribution kernel that includes the fix
Restrict which local users and workloads can bind VFIO devices and issue reset or tracker operations
Audit multi-tenant hypervisors passing mlx5 virtual functions to guests and prioritize them for patching

Patch Information

The fix is available in the upstream Linux stable tree across multiple branches. Reference commits: Kernel Git Commit 1dd99b8, Kernel Git Commit 399d806, Kernel Git Commit 39d1636, Kernel Git Commit 7ed120b, Kernel Git Commit f1db80a, and Kernel Git Commit f2365a6. Rebuild affected kernels or install vendor updates that incorporate these commits, then reboot to activate the patched driver.

Workarounds

If patching is delayed, avoid live migration and runtime dirty page tracking of mlx5 VFIO devices to reduce exposure to the racing code paths
Restrict VFIO device binding to trusted administrators using group permissions on /dev/vfio/* nodes
Unload the mlx5_vfio_pci module on hosts that do not require SR-IOV passthrough for mlx5 devices

bash

# Verify running kernel and check for the mlx5 vfio module
uname -r
lsmod | grep -E 'mlx5_vfio_pci|vfio_pci'

# Restrict VFIO device access to a dedicated group
chgrp vfio /dev/vfio/*
chmod 0660 /dev/vfio/*