CVE-2026-64475

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vfio/pci component where the VGA arbiter client is not released upon a failure in the vfio pci core register device() function. This occurs because a re-ordering of operations displaced vfio pci vga init() as the final failure point without implementing a corresponding unwind mechanism for the VGA arbiter registration. This can lead to a stale registration, potentially leaving a callback with a freed vdev cookie or allowing the callback to follow drvdata to a freed vfio device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.