Executive brief
A vulnerability was identified in the Linux kernel's VFIO CDX driver, which is used to manage hardware devices in virtualized environments. A race condition in how the system handles device interrupts could allow a local attacker to cause a system crash or potentially execute unauthorized code. This issue affects the stability and security of systems using specific hardware acceleration features.
Technical details
A use-after-free vulnerability exists in the Linux kernel's vfio/cdx driver due to a lack of serialization in the vfio_cdx_set_msi_trigger() function. The function reads vdev->config_msi and operates on the vdev->cdx_irqs array without proper locking, allowing concurrent VFIO_DEVICE_SET_IRQS ioctls to race. One thread may observe config_msi as set while another thread clears it and frees the cdx_irqs array via vfio_cdx_msi_disable(), leading to a use-after-free. The fix introduces a per-device mutex (cdx_irqs_lock) to ensure updates to MSI configurations and the IRQ array are atomic.
Affected products
- Linux Linux Kernel Fixed in 6.7, 6.8.9, 6.9.1, and later versions
Timeline
- 2026-04-17: patched: Initial patch authored by Alex Williamson
- 2026-05-27: disclosed: CVE published to NVD