Nvidia CVE-2026-64460

We need to produce a JSON object with all the specified fields. The CVE is about a Linux kernel vulnerability in PCI/IOV, specifically an out-of-bounds access in sriov_restore_vf_rebar_state() when config reads return PCI_ERROR_RESPONSE (~0). That leads to an array index out of bounds (barsz[] index 7 > 6). Fix: bail out if read returns error, and that mirrors pci_restore_rebar_state(). Affected products: Linux kernel, likely many versions. We have references to git commits that fix it. CVSS 7.0 vector: AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H. EPSS 0.21% (low). No KEV, no known POC from input (tags: Nvidia, Buffer Overflow, Linux). Patch available from vendor. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*

Now I'll construct the JSON fields.

product_name: "Linux Kernel" (1-3 words, primary product). I can use "Linux kernel" (lowercase k? The input says "Linux kernel" in description, but CPE is "linux". I'll keep "Linux kernel").

summary: Original synthesis, not copy. Start with impact verb and product. Impact: out-of-bounds array access, leading to potential crash or undefined behavior, but the CVSS says C:L/I:L/A:H, so confidentiality low, integrity low, availability high. So it can cause system crash (availability impact). Summary: "UBSAN array-index-out-of-bounds in the Linux kernel's PCI/IOV subsystem leads to potential system crash when a malfunctioning PCIe device returns PCI_ERROR_RESPONSE during state restoration. Affects all Linux kernel versions that include the vulnerable code (commit 5a8f77e24a30) prior to the fix patches. No active exploitation reported, but local authenticated users with low privileges may trigger it by causing a device to fail." Wait, only local, PR:L. Not actively exploited, EPSS low. So summary: "Local denial of service in Linux kernel PCI/IOV subsystem can be triggered by a malfunctioning device returning error responses, causing an out-of-bounds array access and potentially crashing the system. Affects versions since commit 5a8f77e24a3