Linux kernel (drivers/vfio/cdx): VFIO_DEVICE_SET_IRQS was not serialized, so two concurrent interrupt-configuration

Impact

VFIO_DEVICE_SET_IRQS was not serialized, so two concurrent interrupt-configuration ioctls can have one caller operating on the MSI interrupt array while the other frees it. That is a use-after-free reached directly through the device fd's interrupt-setup ioctl - the textbook shape of a vfio interrupt-index bug, and it lands with tenant-controlled timing.

Who can reach it

Two threads inside a tenant container holding the vfio device fd issue VFIO_DEVICE_SET_IRQS concurrently - one enabling MSI, one disabling. No host privilege and no guest needed. Hardware-conditional: vfio-cdx binds to the AMD/Xilinx CDX bus on Versal-class SoCs, so this is not reachable on x86 or standard Arm GPU nodes. Carry it as a pattern to check for in the PCI SET_IRQS path rather than as a live exposure on a GPU fleet.

What to do

Update to a stable kernel carrying commits ddf96e23 / 7b436ade on any CDX-bus platform. No action needed on x86/Arm GPU nodes that do not build or load vfio-cdx; confirm with lsmod that vfio-cdx is absent.

References