Linux kernel (drivers/vfio/pci): If vfio-pci device registration fails after the device joined the VGA arbiter, the

CVSS 8.8CVE-2026-64475Kernel, userspace & hypervisorcurated

Impact

If vfio-pci device registration fails after the device joined the VGA arbiter, the arbiter keeps a callback registered against a vfio device cookie that is about to be freed. The VGA arbiter then calls into freed state on the next arbitration - a use-after-free on a node where a GPU failed to bind for passthrough, and the upstream note is explicit that it becomes exploitable again as soon as the callback follows drvdata.

Who can reach it

Requires a vfio-pci registration failure on a VGA-class device, so the trigger is host-side provisioning: binding a GPU to vfio-pci where a later registration step fails. Not tenant-initiated. Reachable only on devices that participate in VGA arbitration, which in practice means display-capable GPUs rather than headless datacenter accelerators.

What to do

Update to a stable kernel carrying commits 0f2a35a0 / 8d65decd (5.10.261 / 5.12 / 5.13 are listed by the CNA for older branches). Interim: treat any vfio-pci bind failure on a VGA-capable GPU as requiring a node reboot before the device is offered to a tenant.

References

https://git.kernel.org/stable/c/0f2a35a0c7ea7da347b814750eaa78adf3582381 https://git.kernel.org/stable/c/8d65decde9afd2bd78bcfffdc0df73b82a0b5509 https://nvd.nist.gov/vuln/detail/CVE-2026-64475

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.