Linux kernel (drivers/vfio): Vfio deleted the device before removing its debugfs tree, so debugfs files stay visible

CVSS 5.0CVE-2026-64473Kernel, userspace & hypervisorcurated

Impact

Vfio deleted the device before removing its debugfs tree, so debugfs files stay visible while the devres-allocated state behind them has already been released. Anything that opens those files during the unregister window - which lasts as long as userspace still holds references to the device - reads through a stale inode private pointer into freed memory.

Who can reach it

Needs host root or whatever principal can read /sys/kernel/debug/vfio, and needs the read to land inside the unregister window of a device that a tenant is still holding open. Not tenant-reachable in a normal container (debugfs is not mounted there); the realistic trigger is host monitoring or debugging tooling that walks vfio debugfs while devices are being torn down.

What to do

Update to a stable kernel carrying commits 6cc60b41 / a53109ff. Interim: do not mount debugfs on production tenant nodes, or keep monitoring agents off /sys/kernel/debug/vfio while devices are unbinding.

References

https://git.kernel.org/stable/c/6cc60b41d61657dc469893d14e8e55d160056ff1 https://git.kernel.org/stable/c/a53109ffb6b5148e11a27fb7670355b92db12dd3 https://nvd.nist.gov/vuln/detail/CVE-2026-64473

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.