What is the CVSS score of CVE-2026-64475?

CVE-2026-64475 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64475?

Linux kernel virtualization subsystems (KVM vfio) contain a resource-cleanup defect in device registration failure paths that creates a latent use-after-free vulnerability.. A patch is available.

How to fix or mitigate CVE-2026-64475?

Within 24 hours, identify production systems running Linux kernel with virtualization features enabled (vfio_pci module loaded), particularly those hosting multi-tenant container or KVM workloads. Within 7 days, obtain the patched kernel from your Linux distribution vendor and validate in a non-production virtualization environment before deployment. Within 30 days, schedule kernel updates across all affected systems; patch available per vendor advisory.

Linux Kernel CVE-2026-64475

EUVD-2026-48819 HIGH

2026-07-25 Linux

GHSA-mj56-4c42-9869

Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Registration failure trigger plus callback dereference race requires AC:H; PR:L needed to bind devices to vfio-pci; S:C reflects VGA arbiter system-scope impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 09:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Jul 27, 2026 - 06:00 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

8.8 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:51 cve.org

HIGH 8.8

CVE Published

Jul 25, 2026 - 08:51 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Release the VGA arbiter client on register_device() failure

The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration.

In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could leave a callback with a freed vdev cookie. The stale registration also becomes unsafe again once the callback follows drvdata to the vfio device.

Add the required VGA unwind callout.

AnalysisAI

Missing VGA arbiter client cleanup on vfio/pci registration failure in the Linux kernel leaves a stale callback registered against a freed vdev cookie. The displaced vfio_pci_vga_init() call in vfio_pci_core_register_device() was never paired with an unwind handler, so any failure after VGA arbiter registration exits without releasing the arbiter client. While currently mostly benign because the existing vfio_pci_set_decode() callback only dereferences pci_dev state, the stale registration becomes a live use-after-free vector once any code path makes the callback follow drvdata to the freed vfio device structure. No public exploit has been identified and EPSS is 0.22%, consistent with a latent defect rather than an actively targeted flaw.

Technical ContextAI

VFIO (Virtual Function I/O, cpe:2.3:a:linux:linux) is the Linux kernel subsystem enabling secure PCI device assignment to virtual machines. The VGA arbiter (drivers/gpu/vga/vgaarb.c) manages legacy VGA decode contention across multiple GPUs and registers per-device callbacks invoked when decode permissions change. vfio_pci_vga_init() registers such a callback supplying the vfio_pci_core_device (vdev) as a cookie. A prior commit reordered the failure-path teardown in vfio_pci_core_register_device() so that VGA arbiter registration no longer sits at the end of the init sequence, but no corresponding vga_client_unregister() call was added to the new failure exits. This leaves the arbiter holding a pointer to memory that vfio has freed, constituting a classic CWE-416 use-after-free latent defect on the error path. The CWE field in the source data is listed as N/A, which understates the root cause.

RemediationAI

Vendor-released patches are available across all active stable branches: upgrade to Linux 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc2 as appropriate. Ubuntu users should apply USN-8726-1 or USN-8727-1 (https://ubuntu.com/security/notices/USN-8726-1 and https://ubuntu.com/security/notices/USN-8727-1). The upstream fix commits are available at https://git.kernel.org/stable/c/0f2a35a0c7ea7da347b814750eaa78adf3582381 and related stable backport refs. For systems that cannot be patched immediately, disabling VFIO VGA passthrough (do not bind VGA-capable PCI devices to the vfio-pci driver) eliminates the reachable code path entirely with the trade-off of losing GPU passthrough capability for those devices. No other compensating control fully closes the latent defect.

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64475 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64475

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code