Executive brief
A vulnerability in the Linux kernel's VFIO CDX driver could allow a local user to crash the system. The affected component is responsible for managing hardware device access for virtual machines and userspace applications. By sending specific commands in the wrong order, an attacker can trigger a system failure (NULL pointer dereference), leading to a denial of service.
Technical details
A NULL pointer dereference exists in the vfio/cdx driver within the interrupt trigger path. The function vfio_cdx_set_msi_trigger() failed to validate if Message Signaled Interrupts (MSI) were properly configured before accessing the cdx_irqs array. A local attacker with access to the VFIO device can trigger this by calling VFIO_DEVICE_SET_IRQS with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before the array is allocated via the VFIO_IRQ_SET_DATA_EVENTFD path. This results in a kernel panic. The issue has been resolved by adding a check for the config_msi flag before array access.
Affected products
- Linux Linux Kernel Versions including vfio/cdx support prior to the fix
Timeline
- 2026-04-17: other: Patch submitted by developer
- 2026-05-07: patched: Patch committed to stable trees
- 2026-05-27: disclosed: CVE published