Power Management Flaw in Linux Kernel vfio/pci by Red Hat

CVE-2026-64476

What is CVE-2026-64476?

A vulnerability exists in the vfio/pci module of the Linux Kernel that can lead to unbalanced power management operations. The issue arises from the mismanagement of the disable_idle_d3 flag, which is intended to control device power states. Without proper reference counting and balanced operations, it becomes possible for devices bound to vfio-pci drivers to exhibit inconsistent behavior during power state transitions. This vulnerability can potentially lead to reliability issues within systems utilizing devices managed by the vfio-pci driver.

References