CVE-2026-64460 Linux CVE debrief

Who should care

System administrators and security teams responsible for Linux kernel-based systems, especially those using PCI/IOV-enabled devices, should review and apply patches provided by the Linux kernel maintainers, restrict access to the PCI/IOV configuration space to trusted users, and monitor system logs for potential denial of service or arbitrary code execution attempts. They should also confirm whether affected product deployments exist in managed

Why it matters

This vulnerability in the Linux kernel's PCI/IOV implementation could allow a local attacker with low privileges to cause a denial of service or potentially execute arbitrary code with elevated privileges. System administrators and security teams responsible for Linux kernel-based systems, especially those using PCI/IOV-enabled devices, should review and apply patches provided by the Linux kernel maintainers, restrict access to the PCI/IOV configuration space to trusted users, and monitor system logs for potential denial of service or arbitrary code execution attempts.

• Denial of service due to out-of-bounds array access.
• Potential execution of arbitrary code with elevated privileges.
• Increased risk of system crashes or instability.

Technical summary

The vulnerability is caused by an out-of-bounds array access in the `sriov_restore_vf_rebar_state` function. This function is used to restore the state of Virtual Function (VF) Resizable BARs. When a device does not respond, config reads typically return PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx both evaluate to 7. The barsz[] access then goes out of bounds. The vulnerability affects Linux kernel-based systems, especially those using PCI/IOV-enabled devices. System administrators and security teams should review and apply patches provided by the Linux kernel maintainers.

Defensive priority

High

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers.
• Restrict access to the PCI/IOV configuration space to trusted users.
• Monitor system logs for potential denial of service or arbitrary code execution attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported by an unknown source and is described in the CVE Program record. The NVD entry is currently UNCHANGED. Evidence is limited, and defenders should verify system logs for potential denial of service or arbitrary code execution attempts. The vulnerability affects Linux kernel-based systems, especially those using PCI/IOV-enabled devices. There is no information on known or unknown affected scope.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.