CVE-2026-64460: PCI/IOV: Skip VF Resizable BAR restore on read error
In the Linux kernel, the following vulnerability has been resolved:
PCI/IOV: Skip VF Resizable BAR restore on read error
sriovrestorevfrebarstate() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addresses (baridx). baridx indexes into dev->sriov->barsz[], which has only PCISRIOVNUMBARS (6) entries.
When a device does not respond, config reads typically return PCIERRORRESPONSE (~0). Both fields are 3 bits wide, so nbars and baridx both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN reports this as:
UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resourcesizet [6]'
Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding during a failed GC6 power state exit. The subsequent pcirestorestate() invoked sriovrestorevfrebarstate() while config reads returned 0xffffffff, triggering the splat.
Bail out if any VF Resizable BAR Control read returns PCIERRORRESPONSE. No further VF BARs are touched, which is safe because a config read that returns PCIERRORRESPONSE indicates the device is unreachable and restoration is pointless. This mirrors the guard in pcirestorerebarstate().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In sriov_restore_vf_rebar_state()/rebar restore path, add a guard to bail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE (~0), preventing out-of-bounds access when deciding nbars and bar_idx for dev->sriov->barsz[].
Linux kernel PCI/IOV (drivers/pci/iov.c) VF Resizable BAR Control read error handling = Bail out / skip VF Resizable BAR restore when any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE (~0)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64460?
The severity of CVE-2026-64460 is high with a score of 7 according to CVSS 3.1.
How do I fix CVE-2026-64460?
To fix CVE-2026-64460, upgrade your Linux kernel to the latest patched version provided by your distribution.
What systems are affected by CVE-2026-64460?
CVE-2026-64460 affects systems running the Linux kernel that utilize PCI/IOV features.
What does CVE-2026-64460 exploit?
CVE-2026-64460 exploits a vulnerability in the sriov_restore_vf_rebar_state() function, potentially affecting VF BAR restoration.
Is CVE-2026-64460 a critical vulnerability?
CVE-2026-64460 is classified as a high-risk vulnerability, but not critical, posing significant security concerns in affected systems.