CVE-2026-64042

A flaw was found in the Linux kernel's vfio/pci subsystem. This vulnerability occurs because the Direct Memory Access Buffer (DMABUF) export mechanism does not adequately verify if Base Address Register (BAR) resources are properly reserved before allowing access. A local attacker could exploit this by exporting a DMABUF, potentially gaining unauthorized access to unreserved system resources. This could lead to information disclosure or other unintended system behavior.

This vulnerability is rated as an Important severity because, although exploitation is restricted to local callers with access to VFIO device instances, improper validation allows unauthorized reading and manipulation of host hardware memory outside intended device boundaries. The flaw requires direct interaction with assigned PCI devices utilizing DMA-BUF sharing, a setup typically limited to specialized virtualization or hardware-accelerated workloads. Standard enterprise installations on RHEL 8 and 9 do not include the vulnerable code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.