CVE-2026-64460

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI/IOV: Skip VF Resizable BAR restore on read error

sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register

to decide how many VF BARs to restore (nbars) and which VF BAR each

iteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[],

which has only PCI_SRIOV_NUM_BARS (6) entries.

When a device does not respond, config reads typically return

PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx

both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN

reports this as:

UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]'

Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding

during a failed GC6 power state exit. The subsequent pci_restore_state()

invoked sriov_restore_vf_rebar_state() while config reads returned

0xffffffff, triggering the splat.

Bail out if any VF

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References