GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64042 (GCVE-0-2026-64042)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38
VLAI
Title
vfio/pci: Check BAR resources before exporting a DMABUF
Summary
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's possible to access unreserved resources through the export. Add a check to the DMABUF-creation path.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5d74781ebc86c5fa9e9d6934024c505412de9b52 , < 8443cd4497a4498c4b01058d76a92116244cb605 (git)
Affected: 5d74781ebc86c5fa9e9d6934024c505412de9b52 , < 702809dabdecca807bdd50cfdcc1c980feb2ba62 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8443cd4497a4498c4b01058d76a92116244cb605",
              "status": "affected",
              "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
              "versionType": "git"
            },
            {
              "lessThan": "702809dabdecca807bdd50cfdcc1c980feb2ba62",
              "status": "affected",
              "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/vfio_pci_dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Check BAR resources before exporting a DMABUF\n\nA DMABUF exports access to BAR resources and, although they are\nrequested at startup time, we need to ensure they really were reserved\nbefore exporting.  Otherwise, it\u0027s possible to access unreserved\nresources through the export.\n\nAdd a check to the DMABUF-creation path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the VFIO_DEVICE_FEATURE ioctl on an open VFIO PCI device file descriptor; there is no network, adjacent-radio, or physical-bus entry point to this code.\nAC:L - An attacker with VFIO access can deterministically issue VFIO_DEVICE_FEATURE_DMA_BUF GET requests and probe BAR region indices; when a BAR failed reservation/mapping at enable time, export succeeds without races or attacker-uncontrollable timing.\nPR:L - Exploitation requires access to a VFIO-assigned PCI device (ioctl on /dev/vfio/* or /dev/vfio/devices/*), which is routinely delegated to unprivileged tenants in GPU passthrough/cloud and documented unprivileged VFIO deployments, not init-namespace root.\nUI:N - No victim interaction is required beyond the attacker already holding a VFIO device fd; triggering dma-buf export is a direct ioctl by the attacker process.\nS:C - Exporting an unreserved BAR bypasses VFIO\u2019s BAR reservation/iomap gate and exposes MMIO for peer-to-peer DMA via dma-buf/iommufd/RDMA importers, crossing the IOMMU/DMA security boundary that normal VFIO BAR read/write/mmap paths enforce.\nC:H - The exported dma-buf yields P2P DMA read access to MMIO physical addresses of BAR regions VFIO deliberately did not reserve, enabling disclosure of device registers and sensitive MMIO-backed state beyond the authorized VFIO mapping path.\nI:H - P2P DMA writes through the exported dma-buf can modify MMIO of an unreserved BAR and alter device behavior (including triggering further device DMA side effects), giving a high-integrity write primitive outside the intended VFIO access controls.\nA:H - Unauthorized MMIO access via P2P DMA to unreserved BAR resources can hang or crash device drivers, trigger platform instability during reset/FLR windows, and cause kernel oops/panics from conflicting host/device MMIO use."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:34.964Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605"
        },
        {
          "url": "https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62"
        }
      ],
      "title": "vfio/pci: Check BAR resources before exporting a DMABUF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64042",
    "datePublished": "2026-07-19T15:39:28.604Z",
    "dateReserved": "2026-07-19T07:54:57.029Z",
    "dateUpdated": "2026-08-05T12:38:34.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64042",
      "date": "2026-09-04",
      "epss": "0.00154",
      "percentile": "0.04824"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64042\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:44.480\",\"lastModified\":\"2026-07-30T14:59:47.950\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvfio/pci: Check BAR resources before exporting a DMABUF\\n\\nA DMABUF exports access to BAR resources and, although they are\\nrequested at startup time, we need to ensure they really were reserved\\nbefore exporting.  Otherwise, it\u0027s possible to access unreserved\\nresources through the export.\\n\\nAdd a check to the DMABUF-creation path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/vfio/pci/vfio_pci_dmabuf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5d74781ebc86c5fa9e9d6934024c505412de9b52\",\"lessThan\":\"8443cd4497a4498c4b01058d76a92116244cb605\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5d74781ebc86c5fa9e9d6934024c505412de9b52\",\"lessThan\":\"702809dabdecca807bdd50cfdcc1c980feb2ba62\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/vfio/pci/vfio_pci_dmabuf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-20T15:27:35+00:00",
      "cve": "CVE-2026-64042",
      "id": "CVE-2026-64042",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vfio/pci: Check BAR resources before exporting a DMABUF",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64042.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.