CVE-2026-64476: Linux Kernel Privilege Escalation Flaw

CVE-2026-64476 Overview

CVE-2026-64476 affects the Linux kernel's Virtual Function I/O PCI (vfio-pci) subsystem. The vulnerability stems from the disable_idle_d3 module parameter being latched into vfio-pci-core globals at module init. Loading or reloading the vfio-pci module with different values changes those globals relative to devices already bound to vfio-pci variant drivers. This creates a window where runtime Power Management (PM) get and put operations become unbalanced, corrupting reference counts for PCI devices passed through to virtual machines.

Critical Impact
Unbalanced runtime PM reference counts on vfio-pci devices can lead to devices being placed in incorrect power states, causing device-passthrough failures or kernel warnings on hosts running virtualization workloads.

Affected Products

Linux kernel with vfio-pci-core support (post commit c61302aa48f7)
Linux kernel builds using runtime PM for vfio-pci (post commit 7ab5e10eda02)
Host systems performing PCI device passthrough to virtual machines via vfio-pci variant drivers

Discovery Timeline

2026-07-25 - CVE-2026-64476 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64476

Vulnerability Analysis

The issue arises in the vfio-pci-core kernel module, which brokers PCI device access for virtualization guests. The disable_idle_d3 flag controls whether unused passthrough devices are moved into the D3hot low-power state. Originally the flag was consulted directly at runtime, so changing it produced no reference-counting hazards.

After the vfio-pci-core split in commit c61302aa48f7, the flag value was captured into module-scope globals at init. Runtime PM support in commit 7ab5e10eda02 then made power-state transitions refcounted through balanced pm_runtime_get and pm_runtime_put calls. If an administrator reloaded vfio-pci with a different disable_idle_d3 setting while devices remained bound to variant drivers, the code path taken on put no longer matched the path taken on get.

Root Cause

The root cause is a state-consistency defect: a global configuration value influences reference-counted PM operations but can change beneath live devices. This is effectively a race between module reconfiguration and per-device PM accounting on already-bound devices.

Attack Vector

The defect requires local privileged access to load, unload, or reconfigure kernel modules or write to vfio-pci sysfs entries. It is not a network-reachable vulnerability. Impact is limited to hosts running vfio-pci passthrough, most commonly virtualization hypervisors such as those using QEMU/KVM. The fix latches disable_idle_d3 into vfio_pci_core_device at initialization so each device operates with a consistent value, and vfio_pci_dev_set_try_reset() now unconditionally raises the runtime PM usage count around bus reset.

No public exploitation code exists for this issue. See the upstream fixes for implementation details: Kernel.org Commit 062b820, Kernel.org Commit 4575e9a, and Kernel.org Commit f6c67cf.

Detection Methods for CVE-2026-64476

Indicators of Compromise

Kernel log messages referencing unbalanced runtime PM reference counts on vfio-pci devices, such as Runtime PM usage count underflow warnings tied to PCI BDFs bound to vfio-pci.
Unexpected PCI power-state transitions or device reset failures on hosts performing PCI passthrough.
Guest VMs losing access to passthrough devices after host-side vfio-pci module reload.

Detection Strategies

Audit hosts for kernel versions predating the fix commits and confirm whether vfio-pci variant drivers are in active use.
Monitor for module load/unload events targeting vfio_pci and vfio_pci_core correlated with changes to the disable_idle_d3 parameter in sysfs.
Track kernel ring buffer output for PM-related WARN_ON entries originating from drivers/vfio/pci/.

Monitoring Recommendations

Ship dmesg and journald kernel facility logs to a central SIEM and alert on vfio-pci PM warnings.
Alert on privileged use of modprobe, rmmod, and writes to /sys/module/vfio_pci/parameters/disable_idle_d3 on hypervisor hosts.
Include hypervisor hosts in scheduled kernel version and patch-state inventory checks.

How to Mitigate CVE-2026-64476

Immediate Actions Required

Apply the latest stable kernel updates from your Linux distribution vendor that incorporate the upstream vfio-pci fix.
On unpatched hosts, avoid unloading or reloading the vfio_pci module while devices remain bound to vfio-pci variant drivers.
Do not change disable_idle_d3 at runtime on hosts running production passthrough workloads.

Patch Information

The fix latches disable_idle_d3 into the vfio_pci_core_device structure at device initialization, ensuring per-device consistency. Upstream fixes are available in stable kernel commits including 062b820, 332d785, 4575e9a, 654710e, b982968, and f6c67cf. Consume the fix via your distribution's kernel package when available.

Workarounds

Boot hypervisor hosts with a fixed disable_idle_d3 value on the kernel command line and refrain from modifying it later.
Restrict access to module management utilities and vfio-pci sysfs entries to a minimal set of administrators.
Reboot affected hosts rather than reloading vfio_pci when configuration changes are required.

bash

# Confirm running kernel and vfio-pci module parameter state
uname -r
cat /sys/module/vfio_pci/parameters/disable_idle_d3

# List devices currently bound to vfio-pci to assess exposure
ls -l /sys/bus/pci/drivers/vfio-pci/ | grep '0000:'