---
id: CVE-2026-64475
title: 'vfio/pci: Release the VGA arbiter client on register_device() failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vfio/pci: Release the VGA arbiter client on register_device() failure

  The re-order in the Fixes commit below displaced vfio_pci_vga_init() as
  the last failure point of…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 87856f9af04eaacf9848710625a4ffee1d020fa9 <
    0f2a35a0c7ea7da347b814750eaa78adf3582381
  - >-
    Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae <
    8d65decde9afd2bd78bcfffdc0df73b82a0b5509
  - >-
    Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae <
    ef4c38d30b3744e89eb5048218904bb629ea8d47
  - >-
    Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae <
    9e0a3f642e607848669235f5069f35640abbfc88
  - >-
    Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae <
    42d758a09d2c46c42357ecde9a5492f015bde2e5
  - >-
    Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae <
    52adb2dff7ce3d8430e2bdc5988b618a430def85
  - >-
    Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae <
    278a5659c391fe5afe5f9ce1bad1fd24e90144f1
  - >-
    Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae <
    daedde7f024ecf88bc8e832ed40cf2c795f0796a
  - Linux d62dccb417cf972c978bf3c68a7d5e846bcf953e
  - Linux 6694b8daffac5a8661071f085608afc78f7acd08
  - Linux >= 5.10.37 < 5.10.261
  - Linux >= 5.11.21 < 5.12
  - Linux >= 5.12.4 < 5.13
  - Linux 5.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:41:16.888282Z'
published: '2026-07-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:37.949Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64475'
references:
  - url: 'https://git.kernel.org/stable/c/0f2a35a0c7ea7da347b814750eaa78adf3582381'
  - url: 'https://git.kernel.org/stable/c/8d65decde9afd2bd78bcfffdc0df73b82a0b5509'
  - url: 'https://git.kernel.org/stable/c/ef4c38d30b3744e89eb5048218904bb629ea8d47'
  - url: 'https://git.kernel.org/stable/c/9e0a3f642e607848669235f5069f35640abbfc88'
  - url: 'https://git.kernel.org/stable/c/42d758a09d2c46c42357ecde9a5492f015bde2e5'
  - url: 'https://git.kernel.org/stable/c/52adb2dff7ce3d8430e2bdc5988b618a430def85'
  - url: 'https://git.kernel.org/stable/c/278a5659c391fe5afe5f9ce1bad1fd24e90144f1'
  - url: 'https://git.kernel.org/stable/c/daedde7f024ecf88bc8e832ed40cf2c795f0796a'
tags:
  - cve.org
epss: 0.00139
epssPercentile: 0.02892
ingestedAt: '2026-10-16T17:24:46.823Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Release the VGA arbiter client on register_device() failure

The re-order in the Fixes commit below displaced vfio_pci_vga_init() as
the last failure point of what is now vfio_pci_core_register_device()
without introducing an unwind for the VGA arbiter registration.

In current kernels this is mostly benign because vfio_pci_set_decode()
only uses pci_dev state, but the original failure path could leave a
callback with a freed vdev cookie.  The stale registration also becomes
unsafe again once the callback follows drvdata to the vfio device.

Add the required VGA unwind callout.

## Affected

- `Linux >= 87856f9af04eaacf9848710625a4ffee1d020fa9 < 0f2a35a0c7ea7da347b814750eaa78adf3582381`
- `Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae < 8d65decde9afd2bd78bcfffdc0df73b82a0b5509`
- `Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae < ef4c38d30b3744e89eb5048218904bb629ea8d47`
- `Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae < 9e0a3f642e607848669235f5069f35640abbfc88`
- `Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae < 42d758a09d2c46c42357ecde9a5492f015bde2e5`
- `Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae < 52adb2dff7ce3d8430e2bdc5988b618a430def85`
- `Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae < 278a5659c391fe5afe5f9ce1bad1fd24e90144f1`
- `Linux >= 4aeec3984ddc853f7c65903bde472ffdef738bae < daedde7f024ecf88bc8e832ed40cf2c795f0796a`
- `Linux d62dccb417cf972c978bf3c68a7d5e846bcf953e`
- `Linux 6694b8daffac5a8661071f085608afc78f7acd08`
- `Linux >= 5.10.37 < 5.10.261`
- `Linux >= 5.11.21 < 5.12`
- `Linux >= 5.12.4 < 5.13`
- `Linux 5.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.