CVE-2026-64475: Linux

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration. In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could leave a callback with a freed vdev cookie. The stale registration also becomes unsafe again once the callback follows drvdata to the vfio device. Add the required VGA unwind callout.

Affected products

• Linux Linux: from 5.10.37, before 5.10.261 (fixed in 5.10.261); from 5.11.21, before 5.12 (fixed in 5.12); from 5.12.4, before 5.13 (fixed in 5.13); from 5.13, before 5.15.212 (fixed in 5.15.212); from 5.16, before 6.1.178 (fixed in 6.1.178); from 6.2, before 6.6.145 (fixed in 6.6.145); …

Published 2026-07-25. Last modified 2026-08-17.