CVE-2026-46036vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
- 7.8HighCVSS base score
- 0.14%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex vfio_cdx_set_msi_trigger() reads vdev->config_msi and operates on the vdev->cdx_irqs array based on its value, but provides no serialization against concurrent VFIO_DEVICE_SET_IRQS ioctls. Two callers can race such that one observes config_msi as set while another clears it and frees cdx_irqs via vfio_cdx_msi_disable(), resulting in a use-after-free of the cdx_irqs array. Add a cdx_irqs_lock mutex to struct vfio_cdx_device and acquire it in vfio_cdx_set_msi_trigger(), which is the single chokepoint through which all updates to config_msi, cdx_irqs, and msi_count flow, covering both the ioctl path and the close-device cleanup path. This keeps the test of config_msi atomic with the subsequent enable, disable, or trigger operations. Drop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() as part of this change: the optimization it provided is redundant with the !config_msi early-return inside vfio_cdx_msi_disable(), and leaving the test in place would be an unsynchronized read of state the new lock is meant to protect.
Timeline
ID reserved
By Linux
- 14 days later
· 14 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.14% · top 97% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 848e447e000c41894ff931dc7c004fd42c8840f8 – < ddf96e23c366c566283fce8377928851fa7f5e81
- affected 848e447e000c41894ff931dc7c004fd42c8840f8 – < 7b436ade16cc81095d79b79f8efa3af0a4f5c5a2
- affected 848e447e000c41894ff931dc7c004fd42c8840f8 – < 7530f34ec0ca1438d45a75dcb43183a1cc92eced
- affected 848e447e000c41894ff931dc7c004fd42c8840f8 – < 670e8864b1a218d72f08db40d0103adf38fa1d9b
- affected 6.10
- unaffected < 6.10
- unaffected 6.12.86 – ≤ 6.12.*
- unaffected 6.18.27 – ≤ 6.18.*
- unaffected 7.0.4 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References
References4
- https://git.kernel.org/stable/c/ddf96e23c366c566283fce8377928851fa7f5e81 (opens in a new tab)
- https://git.kernel.org/stable/c/7b436ade16cc81095d79b79f8efa3af0a4f5c5a2 (opens in a new tab)
- https://git.kernel.org/stable/c/7530f34ec0ca1438d45a75dcb43183a1cc92eced (opens in a new tab)
- https://git.kernel.org/stable/c/670e8864b1a218d72f08db40d0103adf38fa1d9b (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-32417 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-46036)Record last updated .