CVE-2026-64476 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Latch disable_idle_d3 per device
When disable_idle_d3 was introduced in vfio-pci, it directly manipulated the device power state with pci_set_power_state(). There were no refcounts to maintain or balanced operations, we could unconditionally bring the device to D0 and conditionally move it to D3hot. Therefore the module parameter was made writable.
Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect of the module parameter was nullified. The parameter value could still be changed through sysfs, but the vfio-pci driver latched the values into vfio-pci-core globals at module init. Loading the vfio-pci module, or unloading and reloading, with non-default or different values could change the globals relative to existing devices bound to vfio-pci variant drivers.
Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the unused device into low power state with runtime PM"), which marks the point where power states became refcounted. PM get and put operations need to be balanced, but the same module operations noted above can change the global variables relative to those devices already bound to vfio-pci variant drivers. This introduces a window where PM operations can now become unbalanced.
To resolve this with a narrow footprint for stable backports, the disable_idle_d3 flag is latched into the vfio_pci_core_device at the time of initialization, such that the device always operates with a consistent value.
NB. vfio_pci_dev_set_try_reset() now unconditionally raises the runtime PM usage count around bus reset to account for disable_idle_d3 becoming a per-device rather than global flag. When this flag is set, the additional get/put pair is harmless and allows continued use of the shared vfio_pci_dev_set_pm_runtime_get() helper.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability in question relates to improper handling of power state management within the Linux kernel's vfio-pci driver, specifically concerning the disable_idle_d3 module parameter. This issue stems from a fundamental design flaw where the module parameter lacked proper reference counting mechanisms when transitioning between device power states. Initially introduced with direct manipulation of pci_set_power_state(), the disable_idle_d3 parameter allowed unconditional movement to D0 state and conditional transition to D3hot state without maintaining balanced operations. The parameter's writability was later removed during a module reorganization in commit c61302aa48f7, where values were latched into global variables at module initialization time rather than being dynamically adjustable.
The complexity of this vulnerability increases with the introduction of Runtime PM capabilities in commit 7ab5e10eda02, which implemented refcounted power management operations. This change created a critical timing window where global variable modifications could occur after devices were already bound to vfio-pci variant drivers, leading to unbalanced power management operations. The inconsistency between the global parameter state and individual device power management contexts created a scenario where runtime PM get and put operations could become mismatched, potentially causing system instability or resource management issues.
This vulnerability manifests as a potential for unbalanced power management operations when devices are bound to vfio-pci drivers with different parameter settings than what was established during module initialization. The security implications extend beyond simple operational instability to potential denial of service conditions where device power states become inconsistent and managed incorrectly throughout the system lifecycle. The fix implemented involves latching the disable_idle_d3 flag directly into the vfio_pci_core_device structure at initialization time, ensuring that each device operates with a consistent value rather than being subject to global parameter changes.
The mitigation strategy addresses this through a narrow code change that maintains backward compatibility while ensuring operational consistency. The solution specifically modifies how vfio_pci_dev_set_try_reset() handles runtime PM usage counts by unconditionally raising the usage count around bus resets when disable_idle_d3 is set. This approach allows continued use of the shared vfio_pci_dev_set_pm_runtime_get() helper function without requiring extensive code restructuring, while ensuring that all power management operations remain balanced and consistent across device lifecycles. The fix aligns with common security practices for managing system state consistency and adheres to CWE principles related to resource management and state handling in kernel drivers, particularly addressing potential issues with improper resource cleanup and inconsistent operational states.