CVE-2026-64473 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
vfio: Remove device debugfs before releasing devres
VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_dev() currently calls vfio_device_del() before vfio_device_debugfs_exit(), but device_del() releases devres. This can leave debugfs entries visible with stale inode private data while unregister waits for userspace references to drain.
Remove the per-device debugfs tree before vfio_device_del(). The debugfs view is diagnostic only, so losing it at the start of unregister is preferable to preserving entries whose backing storage may already have been released.
Complete the teardown by clearing the per-device debugfs root after removal. This matches the global debugfs root cleanup and prevents future users from mistaking a removed dentry for a live debugfs tree during the remainder of unregister.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability exists within the linux kernel's vfio subsystem where improper ordering of resource cleanup operations creates a race condition in debugfs file management. The issue stems from how device debugfs entries are handled during VFIO device unregistration, specifically when using debugfs_create_devm_seqfile() to create debugfs files that store devres allocated debugfs_devm_entry structures as inode private data. When vfio_unregister_group_dev() executes vfio_device_del() before vfio_device_debugfs_exit(), the sequence creates a problematic scenario where device_del() releases devres while debugfs entries remain potentially accessible, leading to stale inode private data references that can cause system instability or information disclosure.
The technical flaw manifests in the improper resource management order where the device removal process occurs before debugfs cleanup, creating a window where debugfs entries may persist with invalid backing storage. This violates proper resource lifecycle management principles and creates a condition where diagnostic debugfs interfaces could expose stale data or trigger memory access violations when userspace attempts to read from these entries. The vulnerability represents a classic case of resource leak and dangling pointer exposure that can be exploited by malicious actors to gain insights into kernel memory state or potentially cause system crashes through invalid memory accesses.
The operational impact of this vulnerability extends beyond simple diagnostic information disclosure, as it creates potential attack vectors for privilege escalation or denial of service conditions. During the unregister process, stale debugfs entries could provide attackers with information about kernel memory layout or device state that would normally be hidden once a device is properly unregistered. This vulnerability affects systems using VFIO (Virtual Function I/O) drivers, particularly those implementing device passthrough functionality, making it relevant to virtualization environments and hardware security scenarios where proper resource cleanup is critical.
The fix implements a corrected teardown sequence by removing the per-device debugfs tree before vfio_device_del() executes, ensuring that all debugfs entries are cleared before devres release occurs. This approach prevents the scenario where debugfs entries might remain accessible with stale private data while unregister waits for userspace references to drain. The solution also includes complete cleanup of the per-device debugfs root after removal, matching the global debugfs root cleanup pattern and preventing future misuse of removed dentries. This remediation aligns with established security practices for resource management and follows the principle of least privilege by ensuring all diagnostic interfaces are properly invalidated during device teardown.
This vulnerability analysis connects to several cybersecurity standards including CWE-691 Uncontrolled Resource Consumption, CWE-457 Use of Uninitialized Variable, and ATT&CK techniques related to privilege escalation through kernel memory corruption. The fix demonstrates proper defensive programming practices that should be applied across kernel subsystems where resource dependencies exist between cleanup operations. The solution represents a targeted approach to resolving resource lifecycle management issues in the Linux kernel's device model and debugfs implementation, addressing both immediate stability concerns and long-term security implications of improper resource handling during device teardown processes.
The remediation addresses fundamental kernel development practices that emphasize proper ordering of cleanup operations and resource dependency management. By ensuring debugfs entries are removed before devres release occurs, the fix prevents a class of race conditions that can occur in complex kernel subsystems where multiple resource types interact during device lifecycle management. This approach aligns with the Linux kernel's security development guidelines and helps maintain system integrity during device registration and unregistration processes, particularly in virtualized environments where VFIO functionality is commonly deployed for hardware passthrough scenarios.