CVE-2026-46036

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex<br /> <br /> vfio_cdx_set_msi_trigger() reads vdev-&gt;config_msi and operates on the<br /> vdev-&gt;cdx_irqs array based on its value, but provides no serialization<br /> against concurrent VFIO_DEVICE_SET_IRQS ioctls. Two callers can race<br /> such that one observes config_msi as set while another clears it and<br /> frees cdx_irqs via vfio_cdx_msi_disable(), resulting in a use-after-free<br /> of the cdx_irqs array.<br /> <br /> Add a cdx_irqs_lock mutex to struct vfio_cdx_device and acquire it in<br /> vfio_cdx_set_msi_trigger(), which is the single chokepoint through<br /> which all updates to config_msi, cdx_irqs, and msi_count flow, covering<br /> both the ioctl path and the close-device cleanup path. This keeps the<br /> test of config_msi atomic with the subsequent enable, disable, or<br /> trigger operations.<br /> <br /> Drop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() as part<br /> of this change: the optimization it provided is redundant with the<br /> !config_msi early-return inside vfio_cdx_msi_disable(), and leaving the<br /> test in place would be an unsynchronized read of state the new lock is<br /> meant to protect.