# CVE-2026-64460: PCI/IOV: Skip VF Resizable BAR restore on read error

> A Linux kernel bug causes an out-of-bounds array access when restoring PCI VF state after a device read error, leading to a system crash.

- **Severity:** High 7.0 (`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 25 Jul 2026
- **Updated:** 19 Oct 2026
- **Also known as:** BELL-CVE-2026-64460, DEBIAN-CVE-2026-64460, GHSA-4g8v-7hmf-pf24, ROOT-OS-UBUNTU-2204-CVE-2026-64460, UBUNTU-CVE-2026-64460

## What is CVE-2026-64460?

CVE-2026-64460 is a high-severity vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

PCI/IOV: Skip VF Resizable BAR restore on read error

sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register
to decide how many VF BARs to restore (nbars) and which VF BAR each
iteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[],
which has only PCI_SRIOV_NUM_BARS (6) entries.

When a device does not respond, config reads typically return
PCI_ERROR_RESPONSE (~0).  Both fields are 3 bits wide, so nbars and bar_idx
both evaluate to 7. The barsz[] access then goes out of bounds.  UBSAN
reports this as:

  UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]'

Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding
during a failed GC6 power state exit. The subsequent pci_restore_state()
invoked sriov_restore_vf_rebar_state() while config reads returned
0xffffffff, triggering the splat.

Bail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE.
No further VF BARs are touched, which is safe because a config read that
returns PCI_ERROR_RESPONSE indicates the device is unreachable and
restoration is pointless. This mirrors the guard in
pci_restore_rebar_state().

Weakness: CWE-125 (Out-of-bounds Read)

## Which versions are affected by CVE-2026-64460?


## How do I fix CVE-2026-64460?

Apply the vendor's patch.

## Is CVE-2026-64460 being exploited?

There is no known exploitation of CVE-2026-64460 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-64460 and fix it if it is affected.

What it is: CVE-2026-64460 is a high-severity vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-64460 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-64460/ (Markdown: https://insights.sbomify.com/CVE-2026-64460/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-64460
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64460
- OSV: https://osv.dev/vulnerability/CVE-2026-64460

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-64460/
Summaries are generated and may contain mistakes; the official description above is the record.