CVE-2026-97992

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vhost-vdpa: protect config_ctx from being freed under the config callback

vhost_vdpa_config_cb() loads v->config_ctx and signals it without taking

a reference and without holding any lock:

struct eventfd_ctx *config_ctx = v->config_ctx;

if (config_ctx)

eventfd_signal(config_ctx);

VHOST_VDPA_SET_CONFIG_CALL replaces that field and drops what is normally

the last reference to the old context:

swap(ctx, v->config_ctx);

if (ctx)

eventfd_ctx_put(ctx);

eventfd_ctx_put() drops the last kref and frees the context immediately,

with no RCU grace period, so a callback that has already loaded the

pointer goes on to dereference freed memory. The two sides share no

lock: the ioctl runs under vhost_dev.mutex, while the parent invokes the

callback from its own interrupt or workqueue context.

This is not the reopen refcount underflow fixed by commit f6bbf0010ba0

("vhost-vdpa: fix use-after-free of v->config_ctx"), whi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References