CVE-2026-64472 (GCVE-0-2026-64472)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-08-17 04:56
VLAI
Title
vfio/mlx5: Fix racy bitfields and tighten struct layout
Summary
In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same storage unit. This split takes a binary approach: flags that are only modified pre/post open/close remain bitfields, flags modified from user action, including actions that reach across to another device (ex. reset) use dedicated storage units. Note mlx5_vhca_page_tracker.status is relocated to fill the alignment hole this split exposes. Bitfield justifications: migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe Dedicated storage units: mdev_detach: written in the VF attach/detach event notifier mlx5fv_vf_event() at runtime log_active: written in mlx5vf_start_page_tracker()/ mlx5vf_stop_page_tracker() during runtime dirty tracking deferred_reset: written in mlx5vf_state_mutex_unlock()/ mlx5vf_pci_aer_reset_done() during runtime reset handling is_err: set by tracker error handling and dirty-log polling at runtime object_changed: set by tracker event handling and cleared by dirty-log polling at runtime
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < 1dd99b8f4e143592e12e5a77e7b538bc698116cb (git)
Affected: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < f1db80a67da928a92ba460ede1be52d8941f46be (git)
Affected: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < 399d806f998f7a25405fc1b97227e579aead24af (git)
Affected: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < 7ed120b1a007bace57c461805519d70e1af44e59 (git)
Affected: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < 39d163627b51886492bf31f66cb02c94613d2287 (git)
Affected: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f , < f2365a63b02ddea32e7db78b742c2503ec7b81f1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/mlx5/cmd.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1dd99b8f4e143592e12e5a77e7b538bc698116cb",
              "status": "affected",
              "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
              "versionType": "git"
            },
            {
              "lessThan": "f1db80a67da928a92ba460ede1be52d8941f46be",
              "status": "affected",
              "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
              "versionType": "git"
            },
            {
              "lessThan": "399d806f998f7a25405fc1b97227e579aead24af",
              "status": "affected",
              "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
              "versionType": "git"
            },
            {
              "lessThan": "7ed120b1a007bace57c461805519d70e1af44e59",
              "status": "affected",
              "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
              "versionType": "git"
            },
            {
              "lessThan": "39d163627b51886492bf31f66cb02c94613d2287",
              "status": "affected",
              "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
              "versionType": "git"
            },
            {
              "lessThan": "f2365a63b02ddea32e7db78b742c2503ec7b81f1",
              "status": "affected",
              "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vfio/pci/mlx5/cmd.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/mlx5: Fix racy bitfields and tighten struct layout\n\nBitfield operations are not atomic, they use a read-modify-write\npattern, therefore we should be careful not to pack bitfields that\ncan be concurrently updated into the same storage unit.\n\nThis split takes a binary approach: flags that are only modified\npre/post open/close remain bitfields, flags modified from user\naction, including actions that reach across to another device (ex.\nreset) use dedicated storage units.\n\nNote mlx5_vhca_page_tracker.status is relocated to fill the alignment\nhole this split exposes.\n\nBitfield justifications:\n\n  migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe\n  chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe\n  mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe\n\nDedicated storage units:\n\n  mdev_detach: written in the VF attach/detach event notifier\n               mlx5fv_vf_event() at runtime\n  log_active: written in mlx5vf_start_page_tracker()/\n              mlx5vf_stop_page_tracker() during runtime dirty tracking\n  deferred_reset: written in mlx5vf_state_mutex_unlock()/\n                  mlx5vf_pci_aer_reset_done() during runtime reset handling\n  is_err: set by tracker error handling and dirty-log polling at runtime\n  object_changed: set by tracker event handling and cleared by dirty-log\n                  polling at runtime"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:56:18.199Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1dd99b8f4e143592e12e5a77e7b538bc698116cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1db80a67da928a92ba460ede1be52d8941f46be"
        },
        {
          "url": "https://git.kernel.org/stable/c/399d806f998f7a25405fc1b97227e579aead24af"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ed120b1a007bace57c461805519d70e1af44e59"
        },
        {
          "url": "https://git.kernel.org/stable/c/39d163627b51886492bf31f66cb02c94613d2287"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2365a63b02ddea32e7db78b742c2503ec7b81f1"
        }
      ],
      "title": "vfio/mlx5: Fix racy bitfields and tighten struct layout",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64472",
    "datePublished": "2026-07-25T08:51:35.978Z",
    "dateReserved": "2026-07-19T15:36:31.790Z",
    "dateUpdated": "2026-08-17T04:56:18.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64472",
      "date": "2026-09-22",
      "epss": "0.00181",
      "percentile": "0.07927"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:43:27.000Z",
      "cve": "CVE-2026-64472",
      "id": "msrc_CVE-2026-64472",
      "initial_release_date": "2026-07-26T01:12:41.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "vfio/mlx5: Fix racy bitfields and tighten struct layout",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64472.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/vfio/pci/mlx5/cmd.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1dd99b8f4e143592e12e5a77e7b538bc698116cb",
                    "status": "affected",
                    "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1db80a67da928a92ba460ede1be52d8941f46be",
                    "status": "affected",
                    "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "399d806f998f7a25405fc1b97227e579aead24af",
                    "status": "affected",
                    "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7ed120b1a007bace57c461805519d70e1af44e59",
                    "status": "affected",
                    "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "39d163627b51886492bf31f66cb02c94613d2287",
                    "status": "affected",
                    "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f2365a63b02ddea32e7db78b742c2503ec7b81f1",
                    "status": "affected",
                    "version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/vfio/pci/mlx5/cmd.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/mlx5: Fix racy bitfields and tighten struct layout\n\nBitfield operations are not atomic, they use a read-modify-write\npattern, therefore we should be careful not to pack bitfields that\ncan be concurrently updated into the same storage unit.\n\nThis split takes a binary approach: flags that are only modified\npre/post open/close remain bitfields, flags modified from user\naction, including actions that reach across to another device (ex.\nreset) use dedicated storage units.\n\nNote mlx5_vhca_page_tracker.status is relocated to fill the alignment\nhole this split exposes.\n\nBitfield justifications:\n\n  migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe\n  chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe\n  mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe\n\nDedicated storage units:\n\n  mdev_detach: written in the VF attach/detach event notifier\n               mlx5fv_vf_event() at runtime\n  log_active: written in mlx5vf_start_page_tracker()/\n              mlx5vf_stop_page_tracker() during runtime dirty tracking\n  deferred_reset: written in mlx5vf_state_mutex_unlock()/\n                  mlx5vf_pci_aer_reset_done() during runtime reset handling\n  is_err: set by tracker error handling and dirty-log polling at runtime\n  object_changed: set by tracker event handling and cleared by dirty-log\n                  polling at runtime"
          }
        ],
        "id": "CVE-2026-64472",
        "lastModified": "2026-08-17T05:17:52.820",
        "metrics": {},
        "published": "2026-07-25T10:17:32.630",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1dd99b8f4e143592e12e5a77e7b538bc698116cb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/399d806f998f7a25405fc1b97227e579aead24af"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/39d163627b51886492bf31f66cb02c94613d2287"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7ed120b1a007bace57c461805519d70e1af44e59"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f1db80a67da928a92ba460ede1be52d8941f46be"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f2365a63b02ddea32e7db78b742c2503ec7b81f1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-29T11:47:25+00:00",
      "cve": "CVE-2026-64472",
      "id": "CVE-2026-64472",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vfio/mlx5: Fix racy bitfields and tighten struct layout",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64472.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:39:46Z",
      "cve": "CVE-2026-64472",
      "id": "CVE-2026-64472",
      "initial_release_date": "2026-07-25T15:58:41Z",
      "product_status:known_affected": "540",
      "product_status:known_not_affected": "193",
      "product_status:recommended": "111",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64472",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64472.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.