Look up another CVE · open CVE-2026-64460 in the interactive tracker

CVE-2026-64460

PCI/IOV: Skip VF Resizable BAR restore on read error

7.0 EPSS 0.1% AV:L

Published 2026-07-25 (3 months ago) by the Linux kernel CNA. Subsystem drivers/pci. Debian urgency: unimportant.

What to do, per Debian release

Debian's own status for CVE-2026-64460 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	not affected	6.1.190-1	Nothing to do. bookworm never shipped the vulnerable code.
Debian 13trixie	not affected	6.12.113-1	Nothing to do. trixie never shipped the vulnerable code.
Debian 14forky	fixed	7.1.4-1	Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.4-1	Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[], which has only PCI_SRIOV_NUM_BARS (6) entries. When a device does not respond, config reads typically return PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN reports this as: UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]' Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding during a failed GC6 power state exit. The subsequent pci_restore_state() invoked sriov_restore_vf_rebar_state() while config reads returned 0xffffffff, triggering the splat. Bail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE. No further VF BARs are touched, which is safe because a config read that returns PCI_ERROR_RESPONSE indicates the device is unreachable and restoration is pointless. This mirrors the guard in pci_restore_rebar_state().

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/pci/iov.c

What this is: PCI SUBSYSTEMMAINTAINERS section matched on drivers/pci/ · linux-pci@vger.kernel.org · Supported

Check it on the machine

grep -w CONFIG_PCI_IOV /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

bookwormYnot built on armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
trixieYnot built on armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
forky, sidYnot built on armhf/armmp, armhf/armmp-lpae

Y: built in where it is built at all; some flavours do not build it

Build switch: CONFIG_PCI_IOV

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-07-25 (3 months ago)source
CVSS: 7.0 high
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.14%, higher than 3.0% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: unimportantsource
Subsystem: drivers/pci

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.17	6.18.39	b77524621250
6.17	7.1.4	55fd485e66d0
6.17	7.2	f34f1712229d

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: The flaw is reachable through local device operations, including DRM render-node runtime resume and delegated VFIO reset or power-management paths, rather than network packet processing.
AC:HAttack complexity, high: Triggering the invalid index requires the SR-IOV PF to become PCI-inaccessible so configuration reads return 0xffffffff; the reported failed GC6 exit is a hardware or firmware failure the attacker cannot reliably control.
PR:LPrivileges required, low: An ordinary user with DRM render-node or delegated VFIO access can initiate relevant resume or reset activity without a capability check; only the separate PCI sysfs reset path requires init-namespace root.
UI:NUser interaction, none: The attacker can initiate the device-use, resume, or reset sequence without any action by another user.
S:CScope, changed: In a VFIO PF-passthrough deployment, tenant-controlled device activity and VM teardown can reach host PCI restoration, so a resulting host oops or panic crosses the guest-to-host security boundary.
C:LConfidentiality impact, low: The fixed index reads one resource_size_t immediately beyond the six-entry barsz array; it is not an arbitrary-read primitive, and only a heavily encoded BAR-size value could become observable if the device resumes.
I:LIntegrity impact, low: There is no kernel-memory write primitive, but the value derived from the out-of-bounds word is written to VF Resizable BAR control and could cause limited incorrect device configuration if the device becomes responsive.
A:HAvailability impact, high: UBSAN trap, panic-on-warn, KASAN, or KFENCE configurations can turn the bounds violation into a host oops or panic, causing complete service loss.