CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout

CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vfio/mlx5: Fix racy bitfields and tighten struct layout

Bitfield operations are not atomic, they use a read-modify-write
pattern, therefore we should be careful not to pack bitfields that
can be concurrently updated into the same storage unit.

This split takes a binary approach: flags that are only modified
pre/post open/close remain bitfields, flags modified from user
action, including actions that reach across to another device (ex.
reset) use dedicated storage units.

Note mlx5_vhca_page_tracker.status is relocated to fill the alignment
hole this split exposes.

Bitfield justifications:

  migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe
  chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe
  mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe

Dedicated storage units:

  mdev_detach: written in the VF attach/detach event notifier
               mlx5fv_vf_event() at runtime
  log_active: written in mlx5vf_start_page_tracker()/
              mlx5vf_stop_page_tracker() during runtime dirty tracking
  deferred_reset: written in mlx5vf_state_mutex_unlock()/
                  mlx5vf_pci_aer_reset_done() during runtime reset handling
  is_err: set by tracker error handling and dirty-log polling at runtime
  object_changed: set by tracker event handling and cleared by dirty-log
                  polling at runtime

The Linux kernel CVE team has assigned CVE-2026-64472 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.19 with commit 61a2f1460fd03285ea34c1a235f2f50f71e13a1f and fixed in 6.1.178 with commit 1dd99b8f4e143592e12e5a77e7b538bc698116cb
	Issue introduced in 5.19 with commit 61a2f1460fd03285ea34c1a235f2f50f71e13a1f and fixed in 6.6.145 with commit f1db80a67da928a92ba460ede1be52d8941f46be
	Issue introduced in 5.19 with commit 61a2f1460fd03285ea34c1a235f2f50f71e13a1f and fixed in 6.12.97 with commit 399d806f998f7a25405fc1b97227e579aead24af
	Issue introduced in 5.19 with commit 61a2f1460fd03285ea34c1a235f2f50f71e13a1f and fixed in 6.18.40 with commit 7ed120b1a007bace57c461805519d70e1af44e59
	Issue introduced in 5.19 with commit 61a2f1460fd03285ea34c1a235f2f50f71e13a1f and fixed in 7.1.4 with commit 39d163627b51886492bf31f66cb02c94613d2287
	Issue introduced in 5.19 with commit 61a2f1460fd03285ea34c1a235f2f50f71e13a1f and fixed in 7.2-rc2 with commit f2365a63b02ddea32e7db78b742c2503ec7b81f1

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64472
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/vfio/pci/mlx5/cmd.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1dd99b8f4e143592e12e5a77e7b538bc698116cb
	https://git.kernel.org/stable/c/f1db80a67da928a92ba460ede1be52d8941f46be
	https://git.kernel.org/stable/c/399d806f998f7a25405fc1b97227e579aead24af
	https://git.kernel.org/stable/c/7ed120b1a007bace57c461805519d70e1af44e59
	https://git.kernel.org/stable/c/39d163627b51886492bf31f66cb02c94613d2287
	https://git.kernel.org/stable/c/f2365a63b02ddea32e7db78b742c2503ec7b81f1