PT-2026-64681 · Linux · Linux
CVE-2026-64460
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
PCI/IOV: Skip VF Resizable BAR restore on read error
sriov restore vf rebar state() uses the VF Resizable BAR Control register
to decide how many VF BARs to restore (nbars) and which VF BAR each
iteration addresses (bar idx). bar idx indexes into dev->sriov->barsz[],
which has only PCI SRIOV NUM BARS (6) entries.
When a device does not respond, config reads typically return
PCI ERROR RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar idx
both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN
reports this as:
UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource size t [6]'
Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding
during a failed GC6 power state exit. The subsequent pci restore state()
invoked sriov restore vf rebar state() while config reads returned
0xffffffff, triggering the splat.
Bail out if any VF Resizable BAR Control read returns PCI ERROR RESPONSE.
No further VF BARs are touched, which is safe because a config read that
returns PCI ERROR RESPONSE indicates the device is unreachable and
restoration is pointless. This mirrors the guard in
pci restore rebar state().
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux