CVE-2026-64042

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64042", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.029Z", "datePublished": "2026-07-19T15:39:28.604Z", "dateUpdated": "2026-08-05T12:38:34.964Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:38:34.964Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Check BAR resources before exporting a DMABUF\n\nA DMABUF exports access to BAR resources and, although they are\nrequested at startup time, we need to ensure they really were reserved\nbefore exporting. Otherwise, it's possible to access unreserved\nresources through the export.\n\nAdd a check to the DMABUF-creation path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through the VFIO_DEVICE_FEATURE ioctl on an open VFIO PCI device file descriptor; there is no network, adjacent-radio, or physical-bus entry point to this code.\nAC:L - An attacker with VFIO access can deterministically issue VFIO_DEVICE_FEATURE_DMA_BUF GET requests and probe BAR region indices; when a BAR failed reservation/mapping at enable time, export succeeds without races or attacker-uncontrollable timing.\nPR:L - Exploitation requires access to a VFIO-assigned PCI device (ioctl on /dev/vfio/* or /dev/vfio/devices/*), which is routinely delegated to unprivileged tenants in GPU passthrough/cloud and documented unprivileged VFIO deployments, not init-namespace root.\nUI:N - No victim interaction is required beyond the attacker already holding a VFIO device fd; triggering dma-buf export is a direct ioctl by the attacker process.\nS:C - Exporting an unreserved BAR bypasses VFIO\u2019s BAR reservation/iomap gate and exposes MMIO for peer-to-peer DMA via dma-buf/iommufd/RDMA importers, crossing the IOMMU/DMA security boundary that normal VFIO BAR read/write/mmap paths enforce.\nC:H - The exported dma-buf yields P2P DMA read access to MMIO physical addresses of BAR regions VFIO deliberately did not reserve, enabling disclosure of device registers and sensitive MMIO-backed state beyond the authorized VFIO mapping path.\nI:H - P2P DMA writes through the exported dma-buf can modify MMIO of an unreserved BAR and alter device behavior (including triggering further device DMA side effects), giving a high-integrity write primitive outside the intended VFIO access controls.\nA:H - Unauthorized MMIO access via P2P DMA to unreserved BAR resources can hang or crash device drivers, trigger platform instability during reset/FLR windows, and cause kernel oops/panics from conflicting host/device MMIO use."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "versions": [{"version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "lessThan": "8443cd4497a4498c4b01058d76a92116244cb605", "status": "affected", "versionType": "git"}, {"version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "lessThan": "702809dabdecca807bdd50cfdcc1c980feb2ba62", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605"}, {"url": "https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62"}], "title": "vfio/pci: Check BAR resources before exporting a DMABUF", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8443cd4497a4498c4b01058d76a92116244cb605", "status": "affected", "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "versionType": "git"}, {"lessThan": "702809dabdecca807bdd50cfdcc1c980feb2ba62", "status": "affected", "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Check BAR resources before exporting a DMABUF\n\nA DMABUF exports access to BAR resources and, although they are\nrequested at startup time, we need to ensure they really were reserved\nbefore exporting. Otherwise, it's possible to access unreserved\nresources through the export.\n\nAdd a check to the DMABUF-creation path."}], "id": "CVE-2026-64042", "lastModified": "2026-10-05T18:22:30.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T16:17:44.480", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: vfio/pci: Check BAR resources before exporting a DMABUF", "id": "2502547", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502547"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1220", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvfio/pci: Check BAR resources before exporting a DMABUF\nA DMABUF exports access to BAR resources and, although they are\nrequested at startup time, we need to ensure they really were reserved\nbefore exporting. Otherwise, it's possible to access unreserved\nresources through the export.\nAdd a check to the DMABUF-creation path.", "A flaw was found in the Linux kernel's vfio/pci subsystem. This vulnerability occurs because the Direct Memory Access Buffer (DMABUF) export mechanism does not adequately verify if Base Address Register (BAR) resources are properly reserved before allowing access. A local attacker could exploit this by exporting a DMABUF, potentially gaining unauthorized access to unreserved system resources. This could lead to information disclosure or other unintended system behavior."], "name": "CVE-2026-64042", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64042\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64042\nhttps://lore.kernel.org/linux-cve-announce/2026071906-CVE-2026-64042-c30f@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5d74781ebc86c5fa9e9d6934024c505412de9b52,8443cd4497a4498c4b01058d76a92116244cb605)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5d74781ebc86c5fa9e9d6934024c505412de9b52,702809dabdecca807bdd50cfdcc1c980feb2ba62)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,7.2.0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T08:45:02.486735+00:00", "updated": "2026-10-05T20:30:22.441479+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}