CVE-2026-64475

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Release the VGA arbiter client on register_device() failure

The re-order in the Fixes commit below displaced vfio_pci_vga_init() as

the last failure point of what is now vfio_pci_core_register_device()

without introducing an unwind for the VGA arbiter registration.

In current kernels this is mostly benign because vfio_pci_set_decode()

only uses pci_dev state, but the original failure path could leave a

callback with a freed vdev cookie. The stale registration also becomes

unsafe again once the callback follows drvdata to the vfio device.

Add the required VGA unwind callout.