{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64460","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T15:36:31.789Z","datePublished":"2026-07-25T08:51:27.568Z","dateUpdated":"2026-08-17T04:56:05.033Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T04:56:05.033Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/IOV: Skip VF Resizable BAR restore on read error\n\nsriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register\nto decide how many VF BARs to restore (nbars) and which VF BAR each\niteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[],\nwhich has only PCI_SRIOV_NUM_BARS (6) entries.\n\nWhen a device does not respond, config reads typically return\nPCI_ERROR_RESPONSE (~0).  Both fields are 3 bits wide, so nbars and bar_idx\nboth evaluate to 7. The barsz[] access then goes out of bounds.  UBSAN\nreports this as:\n\n  UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]'\n\nObserved on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding\nduring a failed GC6 power state exit. The subsequent pci_restore_state()\ninvoked sriov_restore_vf_rebar_state() while config reads returned\n0xffffffff, triggering the splat.\n\nBail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE.\nNo further VF BARs are touched, which is safe because a config read that\nreturns PCI_ERROR_RESPONSE indicates the device is unreachable and\nrestoration is pointless. This mirrors the guard in\npci_restore_rebar_state()."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reachable through local device operations, including DRM render-node runtime resume and delegated VFIO reset or power-management paths, rather than network packet processing.\nAC:H - Triggering the invalid index requires the SR-IOV PF to become PCI-inaccessible so configuration reads return 0xffffffff; the reported failed GC6 exit is a hardware or firmware failure the attacker cannot reliably control.\nPR:L - An ordinary user with DRM render-node or delegated VFIO access can initiate relevant resume or reset activity without a capability check; only the separate PCI sysfs reset path requires init-namespace root.\nUI:N - The attacker can initiate the device-use, resume, or reset sequence without any action by another user.\nS:C - In a VFIO PF-passthrough deployment, tenant-controlled device activity and VM teardown can reach host PCI restoration, so a resulting host oops or panic crosses the guest-to-host security boundary.\nC:L - The fixed index reads one resource_size_t immediately beyond the six-entry barsz array; it is not an arbitrary-read primitive, and only a heavily encoded BAR-size value could become observable if the device resumes.\nI:L - There is no kernel-memory write primitive, but the value derived from the out-of-bounds word is written to VF Resizable BAR control and could cause limited incorrect device configuration if the device becomes responsive.\nA:H - UBSAN trap, panic-on-warn, KASAN, or KFENCE configurations can turn the bounds violation into a host oops or panic, causing complete service loss."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/pci/iov.c"],"versions":[{"version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","lessThan":"b77524621250407386f44c6eea7e5e4619ada1ce","status":"affected","versionType":"git"},{"version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","lessThan":"55fd485e66d0ad5c762c23dba1461fe9c741cd96","status":"affected","versionType":"git"},{"version":"5a8f77e24a30bbce2fa57926f3dede84894fd10a","lessThan":"f34f1712229d71ce4286440fef12526fd4590b37","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/pci/iov.c"],"versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","status":"unaffected","versionType":"semver"},{"version":"6.18.39","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"6.18.39"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"7.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/b77524621250407386f44c6eea7e5e4619ada1ce"},{"url":"https://git.kernel.org/stable/c/55fd485e66d0ad5c762c23dba1461fe9c741cd96"},{"url":"https://git.kernel.org/stable/c/f34f1712229d71ce4286440fef12526fd4590b37"}],"title":"PCI/IOV: Skip VF Resizable BAR restore on read error","x_generator":{"engine":"bippy-1.2.0"}}}}