Linux kernel (drivers/vfio/cdx): A tenant can call the interrupt-configuration ioctl with the trigger flags before MSI

Impact

A tenant can call the interrupt-configuration ioctl with the trigger flags before MSI has ever been configured, so the driver walks an IRQ array that was never allocated and dereferences NULL. A straight userspace-to-kernel NULL dereference through the passthrough device fd - the same call-ordering assumption that had to be fixed in vfio-pci years earlier.

Who can reach it

A container or VM holding a vfio-cdx device fd, calling VFIO_DEVICE_SET_IRQS with VFIO_IRQ_SET_DATA_BOOL or DATA_NONE before the EVENTFD path has allocated the IRQ array. No host root, no race. Conditional on the AMD/Xilinx CDX bus and the vfio-cdx driver being present - FPGA/embedded hardware rather than a standard GPU node.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: blacklist vfio-cdx on fleets that do not assign CDX devices.

References

Related entries

• Linux kernel (drivers/vfio/cdx): VFIO_DEVICE_SET_IRQS was not serialized, so two concurrent interrupt-configurationCVE-2026-46036 · Linux kernel (drivers/vfio/cdx)High
• OpenSSH client X11 forwarding: a local user can pre-bind the X socket and hijack a forwarded sessionCVE-2026-55655 · OpenSSH client X11 forwarding (abstract UNIX X socket pre-binding)Medium
• Intel VT-d interrupt remapping engine as used by Xen 3.3.x-4.3.x: Proof that interrupt remapping is not a completeCVE-2013-3495 · Intel VT-d interrupt remapping engine as used by Xen 3.3.x-4.3.xMedium
• Xen 3.3.x-4.5.x and Linux kernel through 3.19.1 - PCI command register access for assigned devices: A tenant clears theCVE-2015-2150 · Xen 3.3.x-4.5.x and Linux kernel through 3.19.1 - PCI command register access for assigned devicesMedium
• Intel CPU (AEPIC Leak): Stale data read from the legacy xAPIC MMIO page - leaks SGX enclave and cross-domain dataCVE-2022-21233 · Intel CPU (AEPIC Leak)Medium
• Linux kernel (arch/x86/kvm/vmx): The return stack buffer was not refilled on VM exit when the host used IBRS/eIBRS asCVE-2022-49611 · Linux kernel (arch/x86/kvm/vmx)Medium