CVE-2026-64475
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration. In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could leave a callback with a freed vdev cookie. The stale registration also becomes unsafe again once the callback follows drvdata to the vfio device. Add the required VGA unwind callout.
Affected versions
Linux kernel versions
5.10.37,
5.11.21,
5.12.4,
5.13
and later are affected. Fixed in
5.10.261,
5.15.212,
6.1.178,
6.6.145,
6.12.96,
6.18.39,
7.1.4,
7.2-rc2
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-64475?
CVE-2026-64475 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.10.37 onward and has been patched in 5.10.261, 5.15.212, 6.1.178 and others. CVE-2026-64475 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64475?
Yes. CVE-2026-64475 has been patched. Fixed versions include 5.10.261, 5.15.212, 6.1.178 and others. If you are running Linux kernel 5.10.37 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64475 actively exploited?
No. CVE-2026-64475 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.