Improper resource shutdown or release in Linux kernel - CVE-2026-64254
Published: July 27, 2026
Vulnerability identifier: #VU139735
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64254
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown in ntb_epf_deinit_pci() in the NTB EPF driver when tearing down PCI mappings for BARs that share the same mapped I/O memory. A local user can trigger module removal or device teardown to cause a denial of service.
The issue occurs when PEER_SPAD and CONFIG share a single PCI BAR.
Affected software
Linux kernel
How to mitigate CVE-2026-64254
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/06f6dd2ff2bd07eaf7178a807407ff27e85122b4
- https://git.kernel.org/stable/c/81371dbd23601f67f01372817fdbab42c5601e43
- https://git.kernel.org/stable/c/9764a786ba98db58f0725913c369e721253aba33
- https://git.kernel.org/stable/c/a4be4a1308f02bff79a30eea2d04ead5b63685f2
- https://git.kernel.org/stable/c/d876153680e3d721d385e554def919bce3d18c74
- https://git.kernel.org/stable/c/eb47b9bffd07a47b84910847cb5ea066ce184055