CVE-2026-46034

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio/cdx: Fix NULL pointer dereference in interrupt trigger path<br /> <br /> Add validation to ensure MSI is configured before accessing cdx_irqs<br /> array in vfio_cdx_set_msi_trigger(). Without this check, userspace<br /> can trigger a NULL pointer dereference by calling VFIO_DEVICE_SET_IRQS<br /> with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before<br /> ever setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD.<br /> <br /> The vfio_cdx_msi_enable() function allocates the cdx_irqs array and<br /> sets config_msi to 1 only when called through the EVENTFD path. The<br /> trigger loop (for DATA_BOOL/DATA_NONE) assumed this had already been<br /> done, but there was no enforcement of this call ordering.<br /> <br /> This matches the protection used in the PCI VFIO driver where<br /> vfio_pci_set_msi_trigger() checks irq_is() before the trigger loop.