CVE-2026-64475: Linux Kernel Privilege Escalation Flaw

CVE-2026-64475 Overview

CVE-2026-64475 is a Linux kernel vulnerability in the vfio/pci subsystem. The flaw stems from a missing unwind path for VGA arbiter client registration inside vfio_pci_core_register_device(). A reordering change displaced vfio_pci_vga_init() so that it became the last failure point, but no cleanup was introduced to release the VGA arbiter client if a subsequent step failed.

The result is a stale VGA arbiter registration that can retain a callback pointing to a freed vdev cookie. While the callback currently touches only pci_dev state, the registration becomes unsafe once the callback follows drvdata to the vfio device.

Critical Impact
A local, low-privileged attacker with access to the vfio/pci device path can trigger a use-after-free-class condition through the stale VGA arbiter callback, leading to kernel memory corruption and potential privilege escalation.

Affected Products

Linux kernel branches containing the vfio_pci_core_register_device() reorder referenced in the fix commits
Distributions shipping the affected upstream stable kernels prior to the referenced patch commits
Systems using vfio-pci for PCI passthrough with VGA devices (for example, GPU passthrough to virtual machines)

Discovery Timeline

2026-07-25 - CVE-2026-64475 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64475

Vulnerability Analysis

The vulnerability lives in drivers/vfio/pci/vfio_pci_core.c. During device registration, vfio_pci_core_register_device() calls vfio_pci_vga_init(), which registers a VGA arbiter client via vga_client_register() with a callback bound to the vfio_pci_core_device instance.

Because of a prior reorder, vfio_pci_vga_init() is no longer followed by any registration step that could fail. However, if any failure path executes after vfio_pci_vga_init() succeeds, the VGA arbiter client is not unregistered. The kernel then retains a registered callback that references a vdev cookie whose backing memory has been freed.

The vulnerability is a resource-management error [CWE-459 class] combined with a latent use-after-free [CWE-416 class] on the callback path. Present kernels avoid immediate corruption because vfio_pci_set_decode() only consults pci_dev state, but once the callback dereferences drvdata to reach the vfio device, invocation of the stale callback becomes unsafe.

Root Cause

The root cause is a missing unwind operation. The refactor that moved vfio_pci_vga_init() earlier in vfio_pci_core_register_device() did not introduce a matching vga_client_unregister() call on the failure path. Any subsequent error return leaves the VGA arbiter holding a callback tied to freed vfio device state.

Attack Vector

Exploitation requires local access with the ability to interact with the vfio-pci device registration lifecycle, such as a user in a group permitted to bind or unbind PCI devices to vfio-pci, or a privileged process orchestrating passthrough for virtual machines. An attacker forces vfio_pci_core_register_device() to fail after the VGA arbiter client is registered, then triggers a VGA arbitration event that invokes the stale callback against freed memory.

No public exploit code or proof-of-concept has been observed for CVE-2026-64475. Details of the fix are available in the upstream stable commits referenced by NVD, including commit 0f2a35a0c7ea and commit 278a5659c391.

Detection Methods for CVE-2026-64475

Indicators of Compromise

Kernel oops or panic messages referencing vfio_pci_set_decode, vga_arbiter, or vfio_pci_core_register_device in dmesg or /var/log/kern.log
Unexpected slab corruption reports (KASAN use-after-free) implicating the vfio-pci module
Repeated failed bind operations against /sys/bus/pci/drivers/vfio-pci/bind immediately preceding VGA arbitration events

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface use-after-free access on the VGA arbiter callback path
Audit kernel version strings across the fleet with uname -r and cross-reference against the fixed upstream stable commits listed in the NVD entry
Monitor for non-root processes gaining membership in groups that own /dev/vfio/* and can drive PCI rebinding

Monitoring Recommendations

Ship kernel ring buffer events and auditd records covering PCI driver bind or unbind actions to a centralized log platform
Alert on module load or reload events for vfio_pci_core and vfio_pci on production hosts
Track hypervisor hosts performing GPU passthrough as high-value assets, since they are the primary environments exercising the affected code path

How to Mitigate CVE-2026-64475

Immediate Actions Required

Apply the upstream stable kernel updates that add the vga_client_unregister() unwind to vfio_pci_core_register_device() failure paths
Restrict access to /dev/vfio/* and PCI driver bind interfaces to trusted administrators only
Unload the vfio-pci module on hosts that do not require PCI passthrough until patches are deployed

Patch Information

Upstream fixes are available across multiple stable branches. Reference commits include 0f2a35a0c7ea, 278a5659c391, 42d758a09d2c, 52adb2dff7ce, 8d65decde9af, 9e0a3f642e60, daedde7f024e, and ef4c38d30b37. Deploy the corresponding distribution kernel update as soon as it becomes available.

Workarounds

Disable PCI passthrough for VGA-class devices on hosts that do not strictly require it by blacklisting vfio-pci or removing device IDs from its bind list
Constrain which accounts can write to /sys/bus/pci/drivers/vfio-pci/bind and unbind using strict Unix permissions and udev rules
Where feasible, isolate GPU passthrough workloads onto dedicated hosts to reduce the local attack surface

bash

# Verify current kernel and vfio-pci module status
uname -r
lsmod | grep vfio_pci

# Temporarily unload vfio-pci if passthrough is not in use
sudo modprobe -r vfio_pci vfio_pci_core

# Blacklist the module until patches are deployed
echo 'blacklist vfio_pci' | sudo tee /etc/modprobe.d/blacklist-vfio-pci.conf
sudo update-initramfs -u