CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc

vfio_mig_get_next_state() walks vfio_from_fsm_table[] one step at a time,
looping to skip optional states the device does not support until
*next_fsm is supported. A blocked transition is encoded as
VFIO_DEVICE_STATE_ERROR, which the trailing return reports as -EINVAL.

The skip loop does not account for the ERROR sentinel.
state_flags_table[ERROR] is ~0U and vfio_from_fsm_table[ERROR][*] is
ERROR, so once *next_fsm becomes ERROR the loop condition stays true and
*next_fsm never changes. The blocked arcs STOP_COPY -> PRE_COPY and
STOP_COPY -> PRE_COPY_P2P map to ERROR yet pass the support check on a
precopy-capable device, causing the loop to spin forever while holding
the driver state mutex. This can result in a soft lockup, and a panic
with softlockup_panic set.

Terminate the skip loop on the ERROR sentinel so a blocked transition
falls through to the existing return and reports -EINVAL.

The Linux kernel CVE team has assigned CVE-2026-64474 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.2 with commit 4db52602a6074e9cc523500b8304600ff63e7b85 and fixed in 6.6.145 with commit 8e872c07e40d51a66dee7b280a23a460a2e1e3fa
	Issue introduced in 6.2 with commit 4db52602a6074e9cc523500b8304600ff63e7b85 and fixed in 6.12.96 with commit ed7d5599e6c398da74845767cd1e6a8370a160fc
	Issue introduced in 6.2 with commit 4db52602a6074e9cc523500b8304600ff63e7b85 and fixed in 6.18.39 with commit 7f2d6b31089e48db4653df832c9a6afdde9a1c29
	Issue introduced in 6.2 with commit 4db52602a6074e9cc523500b8304600ff63e7b85 and fixed in 7.1.4 with commit a3a8afa2f6e7f0dc266d08f02be3f3054241ba47
	Issue introduced in 6.2 with commit 4db52602a6074e9cc523500b8304600ff63e7b85 and fixed in 7.2-rc1 with commit a26b499b757cfc8bbff1088bb1b844639e250893

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64474
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/vfio/vfio_main.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8e872c07e40d51a66dee7b280a23a460a2e1e3fa
	https://git.kernel.org/stable/c/ed7d5599e6c398da74845767cd1e6a8370a160fc
	https://git.kernel.org/stable/c/7f2d6b31089e48db4653df832c9a6afdde9a1c29
	https://git.kernel.org/stable/c/a3a8afa2f6e7f0dc266d08f02be3f3054241ba47
	https://git.kernel.org/stable/c/a26b499b757cfc8bbff1088bb1b844639e250893