CVE-2026-64476

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio/pci: Latch disable_idle_d3 per device<br /> <br /> When disable_idle_d3 was introduced in vfio-pci, it directly manipulated<br /> the device power state with pci_set_power_state(). There were no<br /> refcounts to maintain or balanced operations, we could unconditionally<br /> bring the device to D0 and conditionally move it to D3hot. Therefore<br /> the module parameter was made writable.<br /> <br /> Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to<br /> vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect<br /> of the module parameter was nullified. The parameter value could still<br /> be changed through sysfs, but the vfio-pci driver latched the values<br /> into vfio-pci-core globals at module init. Loading the vfio-pci module,<br /> or unloading and reloading, with non-default or different values could<br /> change the globals relative to existing devices bound to vfio-pci<br /> variant drivers.<br /> <br /> Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the<br /> unused device into low power state with runtime PM"), which marks the<br /> point where power states became refcounted. PM get and put operations<br /> need to be balanced, but the same module operations noted above can<br /> change the global variables relative to those devices already bound to<br /> vfio-pci variant drivers. This introduces a window where PM operations<br /> can now become unbalanced.<br /> <br /> To resolve this with a narrow footprint for stable backports, the<br /> disable_idle_d3 flag is latched into the vfio_pci_core_device at the<br /> time of initialization, such that the device always operates with a<br /> consistent value.<br /> <br /> NB. vfio_pci_dev_set_try_reset() now unconditionally raises the<br /> runtime PM usage count around bus reset to account for disable_idle_d3<br /> becoming a per-device rather than global flag. When this flag is set,<br /> the additional get/put pair is harmless and allows continued use of the<br /> shared vfio_pci_dev_set_pm_runtime_get() helper.