Linux kernel (drivers/vfio/pci): Vfio-pci exports a dma-buf over BAR memory without confirming those BAR resources were

CVSS 8.8CVE-2026-64042Kernel, userspace & hypervisorcurated

Impact

Vfio-pci exports a dma-buf over BAR memory without confirming those BAR resources were ever actually reserved, so a tenant can obtain a mapping to physical MMIO the driver does not own. That is a handle onto whatever else lives at those addresses - another device's registers, or host-owned MMIO - reachable from inside the container.

Who can reach it

A tenant holding /dev/vfio/<group> calls the vfio-pci dma-buf feature ioctl on a device whose BAR resources were not reserved at probe (BAR sizing quirks, resource conflicts, or a device where the reservation silently failed). Requires the vfio-pci dma-buf export feature to be present and enabled; no host root.

What to do

Update to a stable kernel carrying commits 8443cd44 / 702809da. Interim: do not enable the vfio-pci dma-buf export feature for tenant-held devices, and verify at bind time that each passthrough device's BARs were successfully reserved before handing the group to a tenant.

References

https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605 https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62 https://nvd.nist.gov/vuln/detail/CVE-2026-64042

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.