CVE-2026-64476
kernel: vfio/pci: Latch disable_idle_d3 per device
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 25, 2026
Updated · July 30, 2026
Description
A flaw was found in the Linux kernel's vfio/pci driver. The disable_idle_d3 flag, which controls device power states, was handled as a global module parameter instead of being latched per device. This improper handling could lead to unbalanced Power Management (PM) operations for devices already bound to vfio-pci drivers. Such an imbalance in PM operations can result in unexpected device behavior or instability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE not specified