CVE-2026-64474: Linux Kernel VFIO DoS Vulnerability

CVE-2026-64474 Overview

CVE-2026-64474 is a Linux kernel vulnerability in the Virtual Function I/O (VFIO) subsystem. The flaw resides in vfio_mig_get_next_state(), which walks the vfio_from_fsm_table[] finite state machine one step at a time. The skip loop fails to account for the VFIO_DEVICE_STATE_ERROR sentinel value used to encode blocked transitions. When a precopy-capable device encounters the blocked arcs STOP_COPY -> PRE_COPY or STOP_COPY -> PRE_COPY_P2P, the loop spins forever while holding the driver state mutex. The condition leads to a soft lockup, and a full kernel panic when softlockup_panic is set.

Critical Impact
Local processes with access to a VFIO-managed device can trigger an infinite kernel loop that holds the driver state mutex, resulting in a soft lockup or kernel panic and denying use of the affected system.

Affected Products

Linux kernel VFIO subsystem (versions containing the vfio_mig_get_next_state() skip-loop logic prior to the fix)
Distributions shipping kernels with the VFIO migration state machine that lack the referenced stable commits
Virtualization hosts exposing precopy-capable VFIO devices to guests

Discovery Timeline

2026-07-25 - CVE-2026-64474 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64474

Vulnerability Analysis

The VFIO migration finite state machine transitions a device between states such as RUNNING, STOP, STOP_COPY, PRE_COPY, and PRE_COPY_P2P. vfio_mig_get_next_state() advances one step at a time through vfio_from_fsm_table[], skipping optional states that the device does not support. Blocked transitions are represented by the sentinel VFIO_DEVICE_STATE_ERROR, which the trailing return converts into -EINVAL for the caller.

The skip loop was written without a termination check for the ERROR sentinel. Because state_flags_table[ERROR] is ~0U and vfio_from_fsm_table[ERROR][*] also equals ERROR, once *next_fsm reaches ERROR the loop's support check succeeds indefinitely and the state never advances. The blocked arcs STOP_COPY -> PRE_COPY and STOP_COPY -> PRE_COPY_P2P route into ERROR yet satisfy the support check on a precopy-capable device, triggering the runaway loop.

Root Cause

The root cause is a missing sentinel-termination condition in the state-skip loop combined with the permissive ~0U flags entry for the ERROR slot. The loop trusts that any "supported" next state is a legitimate advance, but the ERROR sentinel satisfies that predicate. This is an [Infinite Loop] defect that becomes a denial-of-service primitive because the loop executes while the driver state mutex is held.

Attack Vector

An attacker requires local access to a process or virtual machine that can request a VFIO device state transition through the VFIO ioctl interface. On a precopy-capable device, requesting the blocked STOP_COPY -> PRE_COPY or STOP_COPY -> PRE_COPY_P2P transition drives *next_fsm to the ERROR sentinel and spins the kernel thread. Because the driver state mutex remains held, other operations against the device stall, and the CPU is consumed until the soft lockup detector fires. Systems configured with softlockup_panic=1 will panic outright.

No verified exploit code is published for this issue. The fix terminates the skip loop when *next_fsm equals the ERROR sentinel, allowing the existing return to report -EINVAL to userspace. See the Linux Kernel Commit Fixes for the authoritative patch content.

Detection Methods for CVE-2026-64474

Indicators of Compromise

Kernel log entries reporting watchdog: BUG: soft lockup - CPU#N stuck with a stack trace referencing vfio_mig_get_next_state or VFIO migration ioctl paths.
Kernel panic records citing softlockup_panic alongside VFIO device migration activity.
Sustained 100% CPU utilization on a kernel thread handling a VFIO ioctl for a precopy-capable device, coincident with an unresponsive VM or workload.

Detection Strategies

Monitor dmesg and /var/log/messages for soft lockup traces whose call stacks include VFIO migration functions.
Alert on unexpected VFIO_DEVICE_FEATURE ioctl sequences that request STOP_COPY followed by PRE_COPY or PRE_COPY_P2P state transitions.
Correlate VM live-migration failures returning -EINVAL from the VFIO subsystem with host CPU stalls to identify systems still running unpatched kernels.

Monitoring Recommendations

Ship kernel logs to a centralized analytics platform and build detections for soft lockup signatures that reference vfio_mig_get_next_state.
Track kernel version inventory across virtualization hosts and flag hosts missing the referenced stable commits.
Instrument hypervisor telemetry to record VFIO state-machine transition attempts and their return codes for post-incident review.

How to Mitigate CVE-2026-64474

Immediate Actions Required

Apply the upstream Linux kernel patch or a distribution kernel update that includes the sentinel-termination fix in vfio_mig_get_next_state().
Restrict access to VFIO device nodes (/dev/vfio/*) to trusted users and virtualization services only.
On hosts that cannot be patched immediately, avoid exposing precopy-capable VFIO devices to untrusted guests.

Patch Information

The fix has been merged into the mainline and stable Linux kernel trees. Reference commits include 7f2d6b31089e, 8e872c07e40d, a26b499b757c, a3a8afa2f6e7, and ed7d5599e6c3. The patch adds a check that terminates the skip loop on the ERROR sentinel so blocked transitions fall through to the existing -EINVAL return path.

Workarounds

Disable precopy migration support on affected VFIO device drivers where operationally feasible.
Set kernel.softlockup_panic=0 on non-critical hosts to prevent full panics while patching is in progress, while accepting that CPU stalls will still occur.
Limit which workloads can invoke VFIO_DEVICE_FEATURE state transitions by tightening cgroup, seccomp, or SELinux/AppArmor policies around virtualization processes.

bash

# Verify the running kernel and check for the fixed commit in your distribution's changelog
uname -r
rpm -q --changelog kernel | grep -E 'vfio_mig_get_next_state|CVE-2026-64474'
# Debian/Ubuntu equivalent
apt changelog linux-image-$(uname -r) | grep -E 'vfio_mig_get_next_state|CVE-2026-64474'

# Restrict access to VFIO device nodes to the vfio group only
chown root:vfio /dev/vfio/*
chmod 0660 /dev/vfio/*