CVE-2026-64042

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's possible to access unreserved resources through the export. Add a check to the DMABUF-creation path.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62	Patch
https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::

History

05 Oct 2026, 18:22

Type	Values Removed	Values Added
CPE		cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
CWE		CWE-862
References	~~() https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62 -~~	() https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62 - Patch
References	~~() https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605 -~~	() https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605 - Patch
First Time		Linux Linux linux Kernel

Information

Published : 2026-07-19 16:17

Updated : 2026-10-05 18:22

NVD link : CVE-2026-64042

Mitre link : CVE-2026-64042

CVE.ORG link : CVE-2026-64042

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-64042", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "lessThan": "8443cd4497a4498c4b01058d76a92116244cb605", "versionType": "git"}, {"status": "affected", "version": "5d74781ebc86c5fa9e9d6934024c505412de9b52", "lessThan": "702809dabdecca807bdd50cfdcc1c980feb2ba62", "versionType": "git"}], "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"status": "unaffected", "version": "0", "lessThan": "6.19", "versionType": "semver"}, {"status": "unaffected", "version": "7.0.11", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/vfio/pci/vfio_pci_dmabuf.c"], "defaultStatus": "affected"}]}], "published": "2026-07-19T16:17:44.480", "references": [{"url": "https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Check BAR resources before exporting a DMABUF\n\nA DMABUF exports access to BAR resources and, although they are\nrequested at startup time, we need to ensure they really were reserved\nbefore exporting. Otherwise, it's possible to access unreserved\nresources through the export.\n\nAdd a check to the DMABUF-creation path."}], "lastModified": "2026-10-05T18:22:30.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}