Not yet scoredPublished Jul 25, 2026

CVE-2026-64472vfio/mlx5: Fix racy bitfields and tighten struct layout

Updated under an hour ago (Oct 26, 2026, 3:23 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same storage unit. This split takes a binary approach: flags that are only modified pre/post open/close remain bitfields, flags modified from user action, including actions that reach across to another device (ex. reset) use dedicated storage units. Note mlx5_vhca_page_tracker.status is relocated to fill the alignment hole this split exposes. Bitfield justifications: migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe Dedicated storage units: mdev_detach: written in the VF attach/detach event notifier mlx5fv_vf_event() at runtime log_active: written in mlx5vf_start_page_tracker()/ mlx5vf_stop_page_tracker() during runtime dirty tracking deferred_reset: written in mlx5vf_state_mutex_unlock()/ mlx5vf_pci_aer_reset_done() during runtime reset handling is_err: set by tracker error handling and dirty-log polling at runtime object_changed: set by tracker event handling and cleared by dirty-log polling at runtime

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	61a2f1460fd03285ea34c1a235f2f50f71e13a1f builds before 1dd99b8f4e143592e12e5a77e7b538bc698116cb; from 61a2f1460fd03285ea34c1a235f2f50f71e13a1f before f1db80a67da928a92ba460ede1be52d8941f46be; from 61a2f1460fd03285ea34c1a235f2f50f71e13a1f before 399d806f998f7a25405fc1b97227e579aead24af; 61a2f1460fd03285ea34c1a235f2f50f71e13a1f builds before 7ed120b1a007bace57c461805519d70e1af44e59; 61a2f1460fd03285ea34c1a235f2f50f71e13a1f builds before 39d163627b51886492bf31f66cb02c94613d2287; from 61a2f1460fd03285ea34c1a235f2f50f71e13a1f before f2365a63b02ddea32e7db78b742c2503ec7b81f1	CNA record

References

References

https://git.kernel.org/stable/c/1dd99b8f4e143592e12e5a77e7b538bc698116cb
https://git.kernel.org/stable/c/f1db80a67da928a92ba460ede1be52d8941f46be
https://git.kernel.org/stable/c/399d806f998f7a25405fc1b97227e579aead24af
https://git.kernel.org/stable/c/7ed120b1a007bace57c461805519d70e1af44e59
https://git.kernel.org/stable/c/39d163627b51886492bf31f66cb02c94613d2287
https://git.kernel.org/stable/c/f2365a63b02ddea32e7db78b742c2503ec7b81f1

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.