CVE-2026-64475

What it actually does

This is a Linux kernel use-after-free flaw in the VFIO PCI VGA-arbitration registration failure path. If vfio_pci_core_register_device() fails after registering a VGA arbiter client, the cleanup path may leave a stale callback associated with a freed VFIO PCI device object. A local attacker with sufficient privileges to interact with VFIO/PCI device assignment paths could potentially trigger the failed registration state and later cause the stale callback to execute, resulting in kernel memory corruption. Because exploitation occurs in kernel context, successful exploitation could lead to privilege escalation, kernel crash, or compromise of confidentiality and integrity on the affected host.

Why it matters to the business

The primary risk is compromise or outage of Linux hosts that expose VFIO PCI passthrough capabilities, especially virtualization, GPU passthrough, appliance, workstation, and cloud/hosting systems where local users or workloads can influence device assignment. A successful exploit could allow a local attacker to gain elevated privileges, escape intended isolation boundaries, or crash the system, disrupting workloads. This issue is not currently listed in CISA KEV, has no known public exploit maturity, and has a low EPSS score, so broad internet-scale exploitation is unlikely; however, the high CVSS impact means exposed multi-user or virtualization hosts should still be prioritized for kernel updates.

How an attack unfolds

An attacker first needs local access with the ability to exercise VFIO PCI registration behavior, typically through access to device assignment, passthrough configuration, or privileged/containerized workflows that can interact with VFIO device nodes or PCI driver binding. The attacker then attempts to force vfio_pci_core_register_device() to fail after VGA arbiter registration has occurred but before normal device registration completes. Because the vulnerable failure path does not unregister the VGA arbiter client, a stale callback can remain associated with memory that has already been freed. The attacker then triggers VGA arbitration behavior that invokes the stale callback. If the freed object has been reclaimed with attacker-influenced data, the callback path may operate on corrupted kernel state, potentially allowing privilege escalation or causing a kernel panic. Exploitation is local and environment-specific, with higher relevance on systems using VFIO PCI passthrough or VGA/GPU assignment.

How to fix it

Upgrade to a Linux kernel version that includes the vfio/pci fix releasing the VGA arbiter client on register_device() failure. If using a distribution kernel, apply the vendor-provided kernel security update rather than relying only on upstream version numbers. Reboot into the patched kernel after installation; live patching may not cover this device-driver cleanup path unless explicitly stated by the vendor. Where immediate patching is not possible, reduce exposure by restricting VFIO access to trusted administrators only, removing unnecessary users from groups that can access /dev/vfio devices, disabling unneeded PCI/GPU passthrough, preventing untrusted workloads from rebinding PCI devices, and limiting access to host-level device-management interfaces. On virtualization hosts, review passthrough policies for GPUs and VGA devices until patched.

How to confirm the fix worked

Confirm the running kernel, not just the installed package, contains the vendor fix. Validate with uname -a and the distribution package manager, then compare against the vendor advisory or changelog for the vfio/pci VGA arbiter cleanup fix. On source-based or custom kernels, verify the patch adds the missing VGA unwind callout when vfio_pci_core_register_device() fails after vfio_pci_vga_init(). Reboot and confirm the patched kernel is active. Check whether VFIO is enabled by looking for loaded vfio modules and /dev/vfio device nodes. Where feasible in a test environment, exercise VFIO PCI registration failure paths with KASAN/KMSAN-enabled kernels and confirm no stale VGA arbiter callback or use-after-free report is produced.

Typical attack path

1. Gain local access to a Linux system where VFIO PCI passthrough or PCI driver rebinding is available.
2. Identify a VGA/GPU PCI device or VFIO PCI path where registration can be exercised.
3. Trigger a vfio_pci_core_register_device() failure after VGA arbiter client registration has occurred.
4. Leave the stale VGA arbiter callback registered against a freed VFIO PCI device object.
5. Trigger VGA arbitration or decode-state handling that invokes the stale callback.
6. Use the resulting use-after-free condition to corrupt kernel memory, escalate privileges, or crash the host.

How to detect it

There are no public exploit-specific indicators for this issue. Detection should focus on evidence of attempted VFIO/PCI manipulation followed by kernel memory-corruption symptoms. Collect kernel logs from journald, syslog, dmesg, hypervisor management logs, audit logs, and endpoint telemetry. Look for VFIO PCI device registration failures, VGA arbiter messages, PCI driver binding or unbinding events, access to /dev/vfio devices, and subsequent kernel warnings such as KASAN use-after-free reports, general protection faults, kernel oopses, or panics. On systems with auditd enabled, review executions or writes involving /sys/bus/pci/drivers/*/bind, /sys/bus/pci/drivers/*/unbind, /sys/bus/pci/devices/*/driver_override, and opens of /dev/vfio/vfio or /dev/vfio/<group>. Correlate suspicious local user activity, container escape attempts, GPU passthrough changes, and unexpected reconfiguration of vfio-pci modules. Absence of these artifacts does not prove non-exploitation, because a successful kernel exploit may leave limited logs or intentionally suppress evidence.

• KASAN: use-after-free
• BUG: KASAN
• use-after-free in vfio
• vfio-pci
• vfio_pci_core_register_device
• vfio_pci_vga_init
• vgaarb
• VGA arbiter
• general protection fault
• kernel BUG
• kernel panic
• Oops:
• /dev/vfio/vfio
• /dev/vfio/
• /sys/bus/pci/drivers/vfio-pci/bind
• /sys/bus/pci/drivers/vfio-pci/unbind
• /sys/bus/pci/devices/
• driver_override
• modprobe vfio-pci
• vfio_pci

What your security team should do

• Inventory Linux systems using VFIO, PCI passthrough, GPU passthrough, or virtualization host roles; prioritize these for patching first.
• Apply the vendor kernel update containing the vfio/pci VGA arbiter cleanup fix and reboot into the patched kernel.
• Restrict access to /dev/vfio/*, PCI driver binding interfaces, and host device-assignment tooling to trusted administrators only.
• Temporarily disable unnecessary GPU/VGA passthrough on multi-user or untrusted workload hosts until patched.
• Review kernel logs for signs of VFIO, VGA arbiter, KASAN, or unexplained kernel crash activity on systems that used VFIO before patching.
• For custom kernels, verify the specific upstream fix is backported rather than assuming the issue is resolved by adjacent VFIO changes.
• Because this is not KEV-listed and has low EPSS, prioritize based on local exposure: virtualization and passthrough hosts first, general single-user systems next.