Executive brief
A vulnerability was identified in the Linux kernel's VFIO (Virtual Function I/O) framework, which is used to provide direct access to hardware devices for virtual machines. A flaw in how the system cleans up diagnostic files during device removal could lead to a system crash or unpredictable behavior if those files are accessed while the device is being disconnected. This issue primarily affects system stability during hardware or virtual machine reconfiguration.
Technical details
A race condition and use-after-free vulnerability exists in the Linux kernel VFIO implementation. The function vfio_unregister_group_dev() was calling vfio_device_del() before vfio_device_debugfs_exit(). Because device_del() triggers the release of devres-managed resources, debugfs entries created via debugfs_create_devm_seqfile() could persist with stale pointers to inode private data. An attacker or local user with access to the debugfs interface could trigger a kernel oops or memory corruption by accessing these entries while the device is unregistering. The fix reorders the teardown sequence to ensure debugfs entries are removed before devres resources are freed.
Affected products
- Linux Linux Kernel 6.8 to 6.12.96, 6.18.39, 7.1.4
Timeline
- 2026-06-15: disclosed: Initial patch submitted by Alex Williamson
- 2026-07-25: advisory: CVE-2026-64473 published in NVD