# CVE-2026-64473: CVE-2026-64473

Status: published. Published: 2026-07-25. Updated: 2026-11-12.

In the Linux kernel, the following vulnerability has been resolved:

vfio: Remove device debugfs before releasing devres

VFIO device debugfs files created with debugfs_create_devm_seqfile()
store a devres allocated debugfs_devm_entry as inode private data.
vfio_unregister_group_dev() currently calls vfio_device_del() before
vfio_device_debugfs_exit(), but device_del() releases devres.  This can
leave debugfs entries visible with stale inode private data while
unregister waits for userspace references to drain.

Remove the per-device debugfs tree before vfio_device_del().  The debugfs
view is diagnostic only, so losing it at the start of unregister is
preferable to preserving entries whose backing storage may already have
been released.

Complete the teardown by clearing the per-device debugfs root after
removal.  This matches the global debugfs root cleanup and prevents
future users from mistaking a removed dentry for a live debugfs tree
during the remainder of unregister.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/6cc60b41d61657dc469893d14e8e55d160056ff1
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/a53109ffb6b5148e11a27fb7670355b92db12dd3
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/a5df401dc84f091e20b045560569f0736758fea7
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/dc7fe87de492ea7f33a72b78d26650b75bf37f4f

## Affected products and versions

- linux / linux_kernel: ≥ 6.8; < 6.12.96 (affected, custom). Source: NVD
- linux / linux_kernel: ≥ 6.13; < 6.18.39 (affected, custom). Source: NVD
- linux / linux_kernel: ≥ 6.19; < 7.1.4 (affected, custom). Source: NVD
- linux / linux_kernel: 7.2 (affected, custom). Source: NVD

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.12.96",
            "versionStartIncluding": "6.8",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.18.39",
            "versionStartIncluding": "6.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "7.1.4",
            "versionStartIncluding": "6.19",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 5.5 (medium); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H; source: NVD: nvd@nist.gov

- CISA KEV: No listing in collected sources

- EPSS: 0.18% as of 2026-11-10; percentile 7.09%

- SSVC: Not available

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/6cc60b41d61657dc469893d14e8e55d160056ff1 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/a53109ffb6b5148e11a27fb7670355b92db12dd3 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/a5df401dc84f091e20b045560569f0736758fea7 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/dc7fe87de492ea7f33a72b78d26650b75bf37f4f (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64473; retrieved 2026-11-12; source updated 2026-11-12

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-64473; retrieved 2026-11-12; source updated Not reported

Revision: c9eefa4bfaa14e6c2f08d0e7b6327f07d95fc43b91530f0bc63d87f2b1cda460

Canonical: https://y2.dev/cve/CVE-2026-64473

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.