CVE-2026-64473: Linux Kernel VFIO Debugfs Vulnerability

CVE-2026-64473 Overview

CVE-2026-64473 is a Linux kernel vulnerability in the Virtual Function I/O (VFIO) subsystem. The issue affects the ordering of debugfs teardown during device unregistration. VFIO debugfs files created with debugfs_create_devm_seqfile() store a devres-allocated debugfs_devm_entry as inode private data. The unregister path calls vfio_device_del() before vfio_device_debugfs_exit(), but device_del() releases devres. This leaves debugfs entries visible with stale inode private data while unregister waits for userspace references to drain. The upstream fix removes the per-device debugfs tree before vfio_device_del() and clears the per-device debugfs root after removal.

Critical Impact
Stale inode private data in VFIO debugfs entries can be accessed after the backing devres storage has been released, creating a use-after-free condition reachable from userspace during device unregister.

Affected Products

Linux kernel VFIO subsystem (upstream)
Stable kernel trees receiving the referenced backports
Distributions shipping kernels with debugfs_create_devm_seqfile()-based VFIO debugfs entries

Discovery Timeline

2026-07-25 - CVE-2026-64473 published to the National Vulnerability Database
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64473

Vulnerability Analysis

The VFIO subsystem exposes per-device diagnostic files through debugfs. These files are created with debugfs_create_devm_seqfile(), which stores a devres-managed debugfs_devm_entry pointer as the inode's private data. Userspace can open, read, and hold references to these files independently of the device's lifecycle.

During device teardown, vfio_unregister_group_dev() invokes vfio_device_del() before calling vfio_device_debugfs_exit(). vfio_device_del() triggers device_del(), which releases devres allocations tied to the device. The debugfs entries remain published in the filesystem until the later vfio_device_debugfs_exit() call. Between these two steps, the debugfs inodes reference freed memory.

The unregister path can block for extended periods while waiting for open userspace file descriptors to drain. Any read against a stale VFIO debugfs file during that window dereferences the released debugfs_devm_entry object.

Root Cause

The root cause is incorrect teardown ordering between devres release and debugfs entry removal. The fix inverts the order so the per-device debugfs tree is removed before vfio_device_del() runs, and the per-device debugfs root pointer is cleared after removal to prevent later code paths from treating a removed dentry as a live tree.

Attack Vector

Exploitation requires a local user with sufficient privileges to open VFIO debugfs files, which are typically root-restricted. A process holds an open file descriptor to a VFIO device debugfs entry while the underlying device is unbound or removed. Reads issued after device_del() completes but before debugfs cleanup finishes operate on freed devres memory. The vulnerability is diagnostic in scope and depends on debugfs being mounted and accessible.

See the upstream patches for implementation details: kernel commit 6cc60b4, kernel commit a53109f, kernel commit a5df401, and kernel commit dc7fe87.

Detection Methods for CVE-2026-64473

Indicators of Compromise

Kernel oops or KASAN: use-after-free reports referencing debugfs_devm_entry, debugfs_create_devm_seqfile, or VFIO paths in the call trace
Crashes correlated with VFIO device unbind, hot-unplug, or driver removal events
Unexpected reads on /sys/kernel/debug/vfio/<device>/ files during device removal

Detection Strategies

Enable KASAN and lockdep on test kernels to surface use-after-free access to freed devres allocations during VFIO teardown
Review dmesg and journalctl -k output for VFIO-related warnings around device unregister
Track running kernel versions against the fixed commits listed on the NVD advisory

Monitoring Recommendations

Alert on kernel panics or KASAN reports on hosts running VFIO workloads such as PCI passthrough for virtualization
Monitor for unauthorized processes opening files under /sys/kernel/debug/vfio/
Log driver bind and unbind events for devices assigned to vfio-pci

How to Mitigate CVE-2026-64473

Immediate Actions Required

Inventory hosts running kernels with the VFIO subsystem enabled, particularly virtualization hypervisors using PCI passthrough
Apply the upstream fix or the stable-tree backport that reorders debugfs removal ahead of vfio_device_del()
Restrict access to debugfs on production systems by unmounting it or limiting mount permissions to root

Patch Information

The fix is available in the mainline Linux kernel and stable branches through the following commits: 6cc60b4, a53109f, a5df401, and dc7fe87. Rebuild and deploy a kernel that includes the reordered teardown or install the corresponding distribution update once available.

Workarounds

Do not mount debugfs on production hosts where the patch cannot be applied immediately
Avoid dynamic unbind or hot-removal of VFIO-managed devices while userspace processes hold VFIO debugfs file descriptors
Restrict CAP_SYS_ADMIN and root-equivalent access on hypervisor hosts to limit who can open VFIO debugfs entries

bash

# Unmount debugfs as a temporary hardening measure
umount /sys/kernel/debug

# Prevent automatic remount by removing debugfs entries from /etc/fstab
# and disable any systemd units that mount it, e.g.:
systemctl mask sys-kernel-debug.mount