CVE-2026-64460

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> PCI/IOV: Skip VF Resizable BAR restore on read error<br /> <br /> sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register<br /> to decide how many VF BARs to restore (nbars) and which VF BAR each<br /> iteration addresses (bar_idx). bar_idx indexes into dev-&gt;sriov-&gt;barsz[],<br /> which has only PCI_SRIOV_NUM_BARS (6) entries.<br /> <br /> When a device does not respond, config reads typically return<br /> PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx<br /> both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN<br /> reports this as:<br /> <br /> UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type &amp;#39;resource_size_t [6]&amp;#39;<br /> <br /> Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding<br /> during a failed GC6 power state exit. The subsequent pci_restore_state()<br /> invoked sriov_restore_vf_rebar_state() while config reads returned<br /> 0xffffffff, triggering the splat.<br /> <br /> Bail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE.<br /> No further VF BARs are touched, which is safe because a config read that<br /> returns PCI_ERROR_RESPONSE indicates the device is unreachable and<br /> restoration is pointless. This mirrors the guard in<br /> pci_restore_rebar_state().