CVE-2026-64460

A flaw was found in the Linux kernel's PCI/IOV subsystem. When a PCI device fails to respond during a power state transition, the kernel's Virtual Function (VF) Resizable Base Address Register (BAR) restoration process can attempt to access memory outside of its allocated bounds. This out-of-bounds memory access can lead to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity for Red Hat because triggering the flaw requires local system access under anomalous hardware circumstances where a PCI device fails during a power transition, resulting in a denial of service. Because the out-of-bounds read error is confined to the kernel's Virtual Function Resizable BAR restoration path and only occurs when an SR-IOV device becomes completely unresponsive, integrity and confidentiality are not directly compromised. Typical enterprise deployments are not exposed unless utilizing specialized SR-IOV-capable hardware that enters and fails to resume from deep power-saving states.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.