Linux kernel (drivers/vfio/pci): The disable_idle_d3 power-management flag was a module-wide global that could change

CVSS 5.5CVE-2026-64476Kernel, userspace & hypervisorcurated

Impact

The disable_idle_d3 power-management flag was a module-wide global that could change out from under devices already bound to vfio-pci, so runtime-PM get/put operations on a passed-through device become unbalanced. An unbalanced PM reference means a device can be dropped into D3hot while a tenant still owns it, or held in D0 forever - device state confusion on the passthrough boundary and a path to refcount underflow.

Who can reach it

Needs host root: loading, unloading, or reloading vfio-pci with a different disable_idle_d3 value, or writing the module parameter through sysfs, while devices are already bound to a vfio-pci variant driver. This is an operator/automation hazard rather than a tenant-reachable one - but it lands directly on devices tenants are actively using.

What to do

Update to a stable kernel carrying commits 332d785f / 654710ef, which latches the flag per device at init. Interim: set disable_idle_d3 once at boot via modprobe.d and never change it or reload vfio-pci while tenant devices are bound.

References

https://git.kernel.org/stable/c/332d785f9ae426eeeb92527872adf09d84101ba3 https://git.kernel.org/stable/c/654710ef3135c4546b20a903bc23a51b0c44d6c8 https://nvd.nist.gov/vuln/detail/CVE-2026-64476

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.