CVE-2026-64472

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

vfio/mlx5: Fix racy bitfields and tighten struct layout

Bitfield operations are not atomic, they use a read-modify-write

pattern, therefore we should be careful not to pack bitfields that

can be concurrently updated into the same storage unit.

This split takes a binary approach: flags that are only modified

pre/post open/close remain bitfields, flags modified from user

action, including actions that reach across to another device (ex.

reset) use dedicated storage units.

Note mlx5_vhca_page_tracker.status is relocated to fill the alignment

hole this split exposes.

Bitfield justifications:

migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe

chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe

mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe

Dedicated storage units:

mdev_detach: written in the VF attach/detach event notifier

mlx5fv_vf_event() at r

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References