# CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device

Status: published. Published: 2026-07-25. Updated: 2026-11-12.

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Latch disable_idle_d3 per device

When disable_idle_d3 was introduced in vfio-pci, it directly manipulated
the device power state with pci_set_power_state().  There were no
refcounts to maintain or balanced operations, we could unconditionally
bring the device to D0 and conditionally move it to D3hot.  Therefore
the module parameter was made writable.

Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to
vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect
of the module parameter was nullified.  The parameter value could still
be changed through sysfs, but the vfio-pci driver latched the values
into vfio-pci-core globals at module init.  Loading the vfio-pci module,
or unloading and reloading, with non-default or different values could
change the globals relative to existing devices bound to vfio-pci
variant drivers.

Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the
unused device into low power state with runtime PM"), which marks the
point where power states became refcounted.  PM get and put operations
need to be balanced, but the same module operations noted above can
change the global variables relative to those devices already bound to
vfio-pci variant drivers.  This introduces a window where PM operations
can now become unbalanced.

To resolve this with a narrow footprint for stable backports, the
disable_idle_d3 flag is latched into the vfio_pci_core_device at the
time of initialization, such that the device always operates with a
consistent value.

NB. vfio_pci_dev_set_try_reset() now unconditionally raises the
runtime PM usage count around bus reset to account for disable_idle_d3
becoming a per-device rather than global flag.  When this flag is set,
the additional get/put pair is harmless and allows continued use of the
shared vfio_pci_dev_set_pm_runtime_get() helper.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/062b820290bcb9778e43a73597df76e9bb08acfb
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/332d785f9ae426eeeb92527872adf09d84101ba3
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/4575e9aac5336d1365138c0284773bf8da4b1fa3
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/654710ef3135c4546b20a903bc23a51b0c44d6c8
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/b98296816d31441b307ef9fa8670dcf5a55e5505
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/f6c67cf0051f96ba61d186731d3d9409b9927db2

## Affected products and versions

- Linux / Linux: ≥ 7ab5e10eda02da1d9562ffde562c51055d368e9c; < 332d785f9ae426eeeb92527872adf09d84101ba3 (affected, git); ≥ 7ab5e10eda02da1d9562ffde562c51055d368e9c; < 654710ef3135c4546b20a903bc23a51b0c44d6c8 (affected, git); ≥ 7ab5e10eda02da1d9562ffde562c51055d368e9c; < b98296816d31441b307ef9fa8670dcf5a55e5505 (affected, git); ≥ 7ab5e10eda02da1d9562ffde562c51055d368e9c; < f6c67cf0051f96ba61d186731d3d9409b9927db2 (affected, git); ≥ 7ab5e10eda02da1d9562ffde562c51055d368e9c; < 062b820290bcb9778e43a73597df76e9bb08acfb (affected, git); ≥ 7ab5e10eda02da1d9562ffde562c51055d368e9c; < 4575e9aac5336d1365138c0284773bf8da4b1fa3 (affected, git). Source: CNA: Linux
- Linux / Linux: 5.19 (affected); ≥ 0; < 5.19 (unaffected, semver); ≥ 6.1.178; ≤ 6.1.* (unaffected, semver); ≥ 6.6.145; ≤ 6.6.* (unaffected, semver); ≥ 6.12.96; ≤ 6.12.* (unaffected, semver); ≥ 6.18.39; ≤ 6.18.* (unaffected, semver); ≥ 7.1.4; ≤ 7.1.* (unaffected, semver); ≥ 7.2; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.1.178",
            "versionStartIncluding": "5.19",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.6.145",
            "versionStartIncluding": "6.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.12.96",
            "versionStartIncluding": "6.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "6.18.39",
            "versionStartIncluding": "6.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "7.1.4",
            "versionStartIncluding": "6.19",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 5.5 (medium); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H; source: NVD: nvd@nist.gov

- CISA KEV: No listing in collected sources

- EPSS: 0.18% as of 2026-11-10; percentile 7.67%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-401

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/332d785f9ae426eeeb92527872adf09d84101ba3 (CNA: Linux)

- https://git.kernel.org/stable/c/654710ef3135c4546b20a903bc23a51b0c44d6c8 (CNA: Linux)

- https://git.kernel.org/stable/c/b98296816d31441b307ef9fa8670dcf5a55e5505 (CNA: Linux)

- https://git.kernel.org/stable/c/f6c67cf0051f96ba61d186731d3d9409b9927db2 (CNA: Linux)

- https://git.kernel.org/stable/c/062b820290bcb9778e43a73597df76e9bb08acfb (CNA: Linux)

- https://git.kernel.org/stable/c/4575e9aac5336d1365138c0284773bf8da4b1fa3 (CNA: Linux)

- https://git.kernel.org/stable/c/062b820290bcb9778e43a73597df76e9bb08acfb (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/332d785f9ae426eeeb92527872adf09d84101ba3 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/4575e9aac5336d1365138c0284773bf8da4b1fa3 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/654710ef3135c4546b20a903bc23a51b0c44d6c8 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/b98296816d31441b307ef9fa8670dcf5a55e5505 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

- https://git.kernel.org/stable/c/f6c67cf0051f96ba61d186731d3d9409b9927db2 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-64476; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64476; retrieved 2026-11-12; source updated 2026-11-12

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-64476; retrieved 2026-11-12; source updated Not reported

Revision: 37f89baa8cb0227293f848b4b9e522b30fd1b1a2fb3155306b1448a51de211a4

Canonical: https://y2.dev/cve/CVE-2026-64476

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.