CVE-2026-46034

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vfio/cdx: Fix NULL pointer dereference in interrupt trigger path

Add validation to ensure MSI is configured before accessing cdx_irqs

array in vfio_cdx_set_msi_trigger(). Without this check, userspace

can trigger a NULL pointer dereference by calling VFIO_DEVICE_SET_IRQS

with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before

ever setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD.

The vfio_cdx_msi_enable() function allocates the cdx_irqs array and

sets config_msi to 1 only when called through the EVENTFD path. The

trigger loop (for DATA_BOOL/DATA_NONE) assumed this had already been

done, but there was no enforcement of this call ordering.

This matches the protection used in the PCI VFIO driver where

vfio_pci_set_msi_trigger() checks irq_is() before the trigger loop.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References