CVE-2026-64473

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the VFIO component where vfio unregister group dev() calls vfio device del() before vfio device debugfs exit(). Because device del() releases devres (device-managed resources), debugfs files created with debugfs create devm seqfile() may retain stale inode private data. This allows debugfs entries to remain visible while the system waits for userspace references to drain, potentially leading to the use of released backing storage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.