Linux kernel (drivers/vfio/cdx): VFIO_DEVICE_SET_IRQS was not serialized, so two concurrent interrupt-configuration

CVSS 7.8CVE-2026-46036Kernel, userspace & hypervisorcurated

Impact

VFIO_DEVICE_SET_IRQS was not serialized, so two concurrent interrupt-configuration ioctls can have one caller operating on the MSI interrupt array while the other frees it. That is a use-after-free reached directly through the device fd's interrupt-setup ioctl - the textbook shape of a vfio interrupt-index bug, and it lands with tenant-controlled timing.

Who can reach it

Two threads inside a tenant container holding the vfio device fd issue VFIO_DEVICE_SET_IRQS concurrently - one enabling MSI, one disabling. No host privilege and no guest needed. Hardware-conditional: vfio-cdx binds to the AMD/Xilinx CDX bus on Versal-class SoCs, so this is not reachable on x86 or standard Arm GPU nodes. Carry it as a pattern to check for in the PCI SET_IRQS path rather than as a live exposure on a GPU fleet.

What to do

Update to a stable kernel carrying commits ddf96e23 / 7b436ade on any CDX-bus platform. No action needed on x86/Arm GPU nodes that do not build or load vfio-cdx; confirm with lsmod that vfio-cdx is absent.

References

https://git.kernel.org/stable/c/ddf96e23c366c566283fce8377928851fa7f5e81 https://git.kernel.org/stable/c/7b436ade16cc81095d79b79f8efa3af0a4f5c5a2 https://nvd.nist.gov/vuln/detail/CVE-2026-46036

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.