VFIO Device Debugfs Vulnerability in Linux Kernel by Linux Foundation

CVE-2026-64473

What is CVE-2026-64473?

In the Linux kernel, a vulnerability has been identified related to VFIO device debugfs files. When these files are created using debugfs_create_devm_seqfile(), they store a device resource (devres) allocated debugfs_devm_entry as inode private data. The issue arises during the unregistration process where vfio_unregister_group_dev() calls vfio_device_del() prior to vfio_device_debugfs_exit(). This sequence can lead to the presence of stale inode private data in debugfs entries, as device_del() releases the devres resources. Consequently, this can result in incorrect representations of removed devices, creating a misleading diagnostic view. The recommended resolution involves removing the per-device debugfs tree before calling vfio_device_del(), ensuring that any stale entries do not persist.

References