CVE-2026-64475

A flaw was found in the Linux kernel's vfio/pci subsystem. A missing cleanup operation during device registration could lead to a stale registration and a callback using freed memory. This vulnerability could result in system instability or potentially lead to a denial of service.

A stale VGA arbiter client registration in vfio/pci can remain after register_device() fails because the failure path did not unregister the VGA callback for the vfio PCI device. The stale registration can keep a freed vdev cookie and a later callback may dereference state associated with the freed vfio device, making this a use-after-free candidate rather than a simple resource leak. For the CVSS the PR:L is used in the paranoid score because some deployments delegate VFIO or PCI device management to reduced capability root, service accounts, or local users with device access rather than full host administration. The issue is not network reachable and requires local interaction with VFIO PCI device setup plus a specific registration failure window. Impact is at least local denial of service and in the worst still defensible case may include confidentiality and integrity impact due to UAF style memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.