Linux kernel (drivers/vfio/cdx): A tenant can call the interrupt-configuration ioctl with the trigger flags before MSI

Impact

A tenant can call the interrupt-configuration ioctl with the trigger flags before MSI has ever been configured, so the driver walks an IRQ array that was never allocated and dereferences NULL. A straight userspace-to-kernel NULL dereference through the passthrough device fd - the same call-ordering assumption that had to be fixed in vfio-pci years earlier.

Who can reach it

A container or VM holding a vfio-cdx device fd, calling VFIO_DEVICE_SET_IRQS with VFIO_IRQ_SET_DATA_BOOL or DATA_NONE before the EVENTFD path has allocated the IRQ array. No host root, no race. Conditional on the AMD/Xilinx CDX bus and the vfio-cdx driver being present - FPGA/embedded hardware rather than a standard GPU node.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: blacklist vfio-cdx on fleets that do not assign CDX devices.

References