Linux Kernel CVE-2026-64460

Exploitation requires: (1) a Linux kernel containing the vulnerable sriov_restore_vf_rebar_state() function, introduced by commit 5a8f77e24a30bbce2fa57926f3dede84894fd10a and unfixed prior to 6.18.39/7.1.4/7.2-rc1; (2) a PCIe device with SR-IOV enabled and VF Resizable BAR support active; (3) the device must become unresponsive to config-space reads (returning PCI_ERROR_RESPONSE/0xffffffff) precisely during a pci_restore_state() invocation - as documented during a failed GC6 power-state exit on NVIDIA RTX PRO 1000 hardware. The high-complexity rating (AC:H) reflects that the device-fault timing condition is not directly attacker-controlled in typical scenarios. Low privilege (PR:L) is required. The bug cannot be triggered remotely and cannot be triggered on systems without SR-IOV-capable devices using VF Resizable BAR.

Real-world risk is low-to-moderate. CVSS 7.0 with AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H correctly identifies the local, high-complexity nature of exploitation, but C:L and I:L are not clearly supported by the description - the observable impact is a kernel crash (DoS), not data exfiltration or integrity corruption. EPSS is 0.21% at the 11th percentile, consistent with low exploitation probability. There is no CISA KEV listing and no known POC code. Triggering the bug requires a specific hardware fault condition: the PCIe device must become unresponsive during pci_restore_state(), a scenario that arises naturally on NVIDIA RTX PRO 1000 hardware with failed GC6 exits but is not a directly controllable attacker primitive in most deployments. A local attacker with device power-management access could theoretically induce the condition to crash the kernel, but the hardware dependency makes reliable weaponization impractical. Priority should be elevated only for systems running SR-IOV-capable GPUs with Resizable BAR and GC6/D3cold power management enabled.

A system with an NVIDIA RTX PRO 1000 GPU attempts to resume from a failed GC6 power-state exit. The GPU stops responding to PCIe config-space reads, returning 0xffffffff for all accesses. The kernel's PM resume path calls pci_restore_state(), which invokes sriov_restore_vf_rebar_state(); the function reads the VF Resizable BAR Control register, receives 0xffffffff, extracts 3-bit fields that both evaluate to 7, and then accesses barsz[7] - one element beyond the 6-entry array - triggering a UBSAN kernel crash and system halt. No public exploit code exists; reliable exploitation requires either the hardware fault to occur naturally or a local attacker with the ability to manipulate device power state.