PT-2026-64681 · Linux · Linux

CVE-2026-64460

·

Publicado

2026-07-25

·

Atualizado

2026-07-25

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
PCI/IOV: Skip VF Resizable BAR restore on read error
sriov restore vf rebar state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addresses (bar idx). bar idx indexes into dev->sriov->barsz[], which has only PCI SRIOV NUM BARS (6) entries.
When a device does not respond, config reads typically return PCI ERROR RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar idx both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN reports this as:
UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource size t [6]'
Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding during a failed GC6 power state exit. The subsequent pci restore state() invoked sriov restore vf rebar state() while config reads returned 0xffffffff, triggering the splat.
Bail out if any VF Resizable BAR Control read returns PCI ERROR RESPONSE. No further VF BARs are touched, which is safe because a config read that returns PCI ERROR RESPONSE indicates the device is unreachable and restoration is pointless. This mirrors the guard in pci restore rebar state().
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64460

Produtos afetados

Linux