PT-2026-64693 · Linux · Linux
CVE-2026-64472
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
vfio/mlx5: Fix racy bitfields and tighten struct layout
Bitfield operations are not atomic, they use a read-modify-write
pattern, therefore we should be careful not to pack bitfields that
can be concurrently updated into the same storage unit.
This split takes a binary approach: flags that are only modified
pre/post open/close remain bitfields, flags modified from user
action, including actions that reach across to another device (ex.
reset) use dedicated storage units.
Note mlx5 vhca page tracker.status is relocated to fill the alignment
hole this split exposes.
Bitfield justifications:
migrate cap: written only in mlx5vf cmd set migratable() at probe
chunk mode: written only in mlx5vf cmd set migratable() at probe
mig state cap: written only in mlx5vf cmd set migratable() at probe
Dedicated storage units:
mdev detach: written in the VF attach/detach event notifier
mlx5fv vf event() at runtime
log active: written in mlx5vf start page tracker()/
mlx5vf stop page tracker() during runtime dirty tracking
deferred reset: written in mlx5vf state mutex unlock()/
mlx5vf pci aer reset done() during runtime reset handling
is err: set by tracker error handling and dirty-log polling at runtime
object changed: set by tracker event handling and cleared by dirty-log
polling at runtime
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux