CVE-2026-64042 (GCVE-0-2026-64042)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-08-05 12:38
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's possible to access unreserved resources through the export. Add a check to the DMABUF-creation path.
References
Impacted products
Vendor Product Version
Linux Linux Version: 5d74781ebc86c5fa9e9d6934024c505412de9b52
Version: 5d74781ebc86c5fa9e9d6934024c505412de9b52
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8443cd4497a4498c4b01058d76a92116244cb605",
              "status": "affected",
              "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
              "versionType": "git"
            },
            {
              "lessThan": "702809dabdecca807bdd50cfdcc1c980feb2ba62",
              "status": "affected",
              "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Check BAR resources before exporting a DMABUF\n\nA DMABUF exports access to BAR resources and, although they are\nrequested at startup time, we need to ensure they really were reserved\nbefore exporting.  Otherwise, it\u0027s possible to access unreserved\nresources through the export.\n\nAdd a check to the DMABUF-creation path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the VFIO_DEVICE_FEATURE ioctl on an open VFIO PCI device file descriptor; there is no network, adjacent-radio, or physical-bus entry point to this code.\nAC:L - An attacker with VFIO access can deterministically issue VFIO_DEVICE_FEATURE_DMA_BUF GET requests and probe BAR region indices; when a BAR failed reservation/mapping at enable time, export succeeds without races or attacker-uncontrollable timing.\nPR:L - Exploitation requires access to a VFIO-assigned PCI device (ioctl on /dev/vfio/* or /dev/vfio/devices/*), which is routinely delegated to unprivileged tenants in GPU passthrough/cloud and documented unprivileged VFIO deployments, not init-namespace root.\nUI:N - No victim interaction is required beyond the attacker already holding a VFIO device fd; triggering dma-buf export is a direct ioctl by the attacker process.\nS:C - Exporting an unreserved BAR bypasses VFIO\u2019s BAR reservation/iomap gate and exposes MMIO for peer-to-peer DMA via dma-buf/iommufd/RDMA importers, crossing the IOMMU/DMA security boundary that normal VFIO BAR read/write/mmap paths enforce.\nC:H - The exported dma-buf yields P2P DMA read access to MMIO physical addresses of BAR regions VFIO deliberately did not reserve, enabling disclosure of device registers and sensitive MMIO-backed state beyond the authorized VFIO mapping path.\nI:H - P2P DMA writes through the exported dma-buf can modify MMIO of an unreserved BAR and alter device behavior (including triggering further device DMA side effects), giving a high-integrity write primitive outside the intended VFIO access controls.\nA:H - Unauthorized MMIO access via P2P DMA to unreserved BAR resources can hang or crash device drivers, trigger platform instability during reset/FLR windows, and cause kernel oops/panics from conflicting host/device MMIO use."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:34.964Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605"
        },
        {
          "url": "https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62"
        }
      ],
      "title": "vfio/pci: Check BAR resources before exporting a DMABUF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64042",
    "datePublished": "2026-07-19T15:39:28.604Z",
    "dateReserved": "2026-07-19T07:54:57.029Z",
    "dateUpdated": "2026-08-05T12:38:34.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.