CVE-2026-46036

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex

vfio_cdx_set_msi_trigger() reads vdev->config_msi and operates on the

vdev->cdx_irqs array based on its value, but provides no serialization

against concurrent VFIO_DEVICE_SET_IRQS ioctls. Two callers can race

such that one observes config_msi as set while another clears it and

frees cdx_irqs via vfio_cdx_msi_disable(), resulting in a use-after-free

of the cdx_irqs array.

Add a cdx_irqs_lock mutex to struct vfio_cdx_device and acquire it in

vfio_cdx_set_msi_trigger(), which is the single chokepoint through

which all updates to config_msi, cdx_irqs, and msi_count flow, covering

both the ioctl path and the close-device cleanup path. This keeps the

test of config_msi atomic with the subsequent enable, disable, or

trigger operations.

Drop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() as part

of this change: the optimization it provided is red

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References