High severity · published Jul 19, 2026
CVE-2026-64042
vfio/pci: Check BAR resources before exporting a DMABUF
8.8
CVSS
0.1%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Check BAR resources before exporting a DMABUF
A DMABUF exports access to BAR resources and, although they are
requested at startup time, we need to ensure they really were reserved
before exporting. Otherwise, it's possible to access unreserved
resources through the export.
Add a check to the DMABUF-creation path.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
6.19 before 7.0.11; 7.1; 7.1; 7.1 · source: NVD
LI
Linux · Linux
5d74781ebc86c5fa9e9d6934024c505412de9b52 before 8443cd4497a4498c4b01058d76a92116244cb605; 5d74781ebc86c5fa9e9d6934024c505412de9b52 before 702809dabdecca807bdd50cfdcc1c980feb2ba62; 6.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64042
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-64042
Patch
https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62
Patch
https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability