Executive brief
A vulnerability in the Linux kernel's PCI subsystem could cause a system crash (kernel panic) when interacting with certain hardware, such as NVIDIA GPUs. This occurs when a hardware device fails to respond properly during power state changes, leading the operating system to attempt invalid memory operations. While primarily a stability issue, it can disrupt system availability and ongoing operations.
Technical details
An array-index-out-of-bounds vulnerability exists in the sriov_restore_vf_rebar_state() function within drivers/pci/iov.c. When a PCI device fails to respond (e.g., during a failed GC6 power state exit), configuration reads return a default error response (0xFFFFFFFF). The kernel incorrectly interprets these bits to determine the number of BARs to restore, resulting in an index of 7 being used for an array with only 6 entries (PCI_SRIOV_NUM_BARS). This out-of-bounds access triggers a kernel splat via UBSAN. The fix introduces checks for PCI_ERROR_RESPONSE to bail out early if the device is unreachable.
Affected products
- Linux Linux Kernel 6.17, 6.18.39, 7.1.4, 7.2-rc1
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory