CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Latch disable_idle_d3 per device

When disable_idle_d3 was introduced in vfio-pci, it directly manipulated
the device power state with pci_set_power_state().  There were no
refcounts to maintain or balanced operations, we could unconditionally
bring the device to D0 and conditionally move it to D3hot.  Therefore
the module parameter was made writable.

Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to
vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect
of the module parameter was nullified.  The parameter value could still
be changed through sysfs, but the vfio-pci driver latched the values
into vfio-pci-core globals at module init.  Loading the vfio-pci module,
or unloading and reloading, with non-default or different values could
change the globals relative to existing devices bound to vfio-pci
variant drivers.

Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the
unused device into low power state with runtime PM"), which marks the
point where power states became refcounted.  PM get and put operations
need to be balanced, but the same module operations noted above can
change the global variables relative to those devices already bound to
vfio-pci variant drivers.  This introduces a window where PM operations
can now become unbalanced.

To resolve this with a narrow footprint for stable backports, the
disable_idle_d3 flag is latched into the vfio_pci_core_device at the
time of initialization, such that the device always operates with a
consistent value.

NB. vfio_pci_dev_set_try_reset() now unconditionally raises the
runtime PM usage count around bus reset to account for disable_idle_d3
becoming a per-device rather than global flag.  When this flag is set,
the additional get/put pair is harmless and allows continued use of the
shared vfio_pci_dev_set_pm_runtime_get() helper.

The Linux kernel CVE team has assigned CVE-2026-64476 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.19 with commit 7ab5e10eda02da1d9562ffde562c51055d368e9c and fixed in 6.1.178 with commit 332d785f9ae426eeeb92527872adf09d84101ba3
	Issue introduced in 5.19 with commit 7ab5e10eda02da1d9562ffde562c51055d368e9c and fixed in 6.6.145 with commit 654710ef3135c4546b20a903bc23a51b0c44d6c8
	Issue introduced in 5.19 with commit 7ab5e10eda02da1d9562ffde562c51055d368e9c and fixed in 6.12.96 with commit b98296816d31441b307ef9fa8670dcf5a55e5505
	Issue introduced in 5.19 with commit 7ab5e10eda02da1d9562ffde562c51055d368e9c and fixed in 6.18.39 with commit f6c67cf0051f96ba61d186731d3d9409b9927db2
	Issue introduced in 5.19 with commit 7ab5e10eda02da1d9562ffde562c51055d368e9c and fixed in 7.1.4 with commit 062b820290bcb9778e43a73597df76e9bb08acfb
	Issue introduced in 5.19 with commit 7ab5e10eda02da1d9562ffde562c51055d368e9c and fixed in 7.2-rc2 with commit 4575e9aac5336d1365138c0284773bf8da4b1fa3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64476
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/vfio/pci/vfio_pci_core.c
	include/linux/vfio_pci_core.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/332d785f9ae426eeeb92527872adf09d84101ba3
	https://git.kernel.org/stable/c/654710ef3135c4546b20a903bc23a51b0c44d6c8
	https://git.kernel.org/stable/c/b98296816d31441b307ef9fa8670dcf5a55e5505
	https://git.kernel.org/stable/c/f6c67cf0051f96ba61d186731d3d9409b9927db2
	https://git.kernel.org/stable/c/062b820290bcb9778e43a73597df76e9bb08acfb
	https://git.kernel.org/stable/c/4575e9aac5336d1365138c0284773bf8da4b1fa3