CVE-2026-64460 - Vulnerability Details

- PCI/IOV: Skip VF Resizable BAR restore on read error

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI/IOV: Skip VF Resizable BAR restore on read error

sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register
to decide how many VF BARs to restore (nbars) and which VF BAR each
iteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[],
which has only PCI_SRIOV_NUM_BARS (6) entries.

When a device does not respond, config reads typically return
PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx
both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN
reports this as:

UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]'

Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding
during a failed GC6 power state exit. The subsequent pci_restore_state()
invoked sriov_restore_vf_rebar_state() while config reads returned
0xffffffff, triggering the splat.

Bail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE.
No further VF BARs are touched, which is safe because a config read that
returns PCI_ERROR_RESPONSE indicates the device is unreachable and
restoration is pointless. This mirrors the guard in
pci_restore_rebar_state().

Published: 2026-07-25

Score: 7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel bug in sriov_restore_vf_rebar_state causes an out-of-bounds array access when a device does not respond, leading to a kernel OOPS that can corrupt memory and crash the system. The fault occurs because PCI config reads return PCI_ERROR_RESPONSE (~0), causing both nbars and bar_idx to be calculated as 7, which exceeds the 6-entry barsz array. The result is a UBSAN array-index-out-of-bounds error that can compromise system stability.

Affected Systems

All Linux kernel versions prior to the commit that adds the boundary check are affected, including systems running NVIDIA RTX GPUs or other PCI/IOV devices that may experience config read failures. The issue exists across the Linux:Linux vendor family and can impact any host that relies on SR‑IOV for virtual function BAR restoration.

Risk and Exploitability

The CVSS score of 7 reflects medium severity, while the EPSS of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation would require an attacker to induce a device fault that causes config reads to return PCI_ERROR_RESPONSE, making remote exploitation unlikely; however, a local hardware failure can bring the kernel down, so patching is advised.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5a8f77e24a30bbce2fa57926f3dede84894fd10a`	affected	< b77524621250407386f44c6eea7e5e4619ada1ce
`5a8f77e24a30bbce2fa57926f3dede84894fd10a`	affected	< 55fd485e66d0ad5c762c23dba1461fe9c741cd96
`5a8f77e24a30bbce2fa57926f3dede84894fd10a`	affected	< f34f1712229d71ce4286440fef12526fd4590b37

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5a8f77e24a30bbce2fa57926f3dede84894fd10a,b77524621250407386f44c6eea7e5e4619ada1ce)`	affected	code_commit	—
`[5a8f77e24a30bbce2fa57926f3dede84894fd10a,55fd485e66d0ad5c762c23dba1461fe9c741cd96)`	affected	code_commit	—
`[5a8f77e24a30bbce2fa57926f3dede84894fd10a,f34f1712229d71ce4286440fef12526fd4590b37)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.17`	affected	generic	—
`[0,6.17)`	unaffected	generic	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel release that includes the fix for the out-of-bounds array check in sriov_restore_vf_rebar_state.
Reboot the system so the patched kernel is in use.
If the VF device continues to exhibit unstable behavior after reboot, check for and apply vendor firmware updates or replace the hardware.

Generated by OpenCVE AI on August 2, 2026 at 12:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00118.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/55fd485e66d0ad5c762c23dba1461fe9c741cd96
https://git.kernel.org/stable/c/b77524621250407386f44c6eea7e5e4619ada1ce
https://git.kernel.org/stable/c/f34f1712229d71ce4286440fef12526fd4590b37
https://lore.kernel.org/linux-cve-announce/2026072543-CVE-2026-64460-5e1d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64460
https://www.cve.org/CVERecord?id=CVE-2026-64460

History

Sat, 01 Aug 2026 02:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-788

Thu, 30 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://lore.kernel.org/linux-cve-announce/2026072543-CVE-2026-64460-5e1d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64460 https://www.cve.org/CVERecord?id=CVE-2026-64460
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 05:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-788

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H'}`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[], which has only PCI_SRIOV_NUM_BARS (6) entries. When a device does not respond, config reads typically return PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN reports this as: UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]' Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding during a failed GC6 power state exit. The subsequent pci_restore_state() invoked sriov_restore_vf_rebar_state() while config reads returned 0xffffffff, triggering the splat. Bail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE. No further VF BARs are touched, which is safe because a config read that returns PCI_ERROR_RESPONSE indicates the device is unreachable and restoration is pointless. This mirrors the guard in pci_restore_rebar_state().
Title		PCI/IOV: Skip VF Resizable BAR restore on read error
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/55fd485e66d0ad5c762c23dba1461fe9c741cd96 https://git.kernel.org/stable/c/b77524621250407386f44c6eea7e5e4619ada1ce https://git.kernel.org/stable/c/f34f1712229d71ce4286440fef12526fd4590b37

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:27.568Z

Updated: 2026-08-05T12:42:18.339Z

Reserved: 2026-07-19T15:36:31.789Z

Link: CVE-2026-64460

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-25T10:17:31.193

Modified: 2026-07-27T05:16:52.540

Link: CVE-2026-64460

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64460 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T12:45:06Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object