CVE-2026-46036
Analyzed Analyzed - Analysis Complete
Race Condition in Linux Kernel VFIO CDX Driver

Publication date: 2026-05-27

Last updated on: 2026-06-16

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex vfio_cdx_set_msi_trigger() reads vdev->config_msi and operates on the vdev->cdx_irqs array based on its value, but provides no serialization against concurrent VFIO_DEVICE_SET_IRQS ioctls. Two callers can race such that one observes config_msi as set while another clears it and frees cdx_irqs via vfio_cdx_msi_disable(), resulting in a use-after-free of the cdx_irqs array. Add a cdx_irqs_lock mutex to struct vfio_cdx_device and acquire it in vfio_cdx_set_msi_trigger(), which is the single chokepoint through which all updates to config_msi, cdx_irqs, and msi_count flow, covering both the ioctl path and the close-device cleanup path. This keeps the test of config_msi atomic with the subsequent enable, disable, or trigger operations. Drop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() as part of this change: the optimization it provided is redundant with the !config_msi early-return inside vfio_cdx_msi_disable(), and leaving the test in place would be an unsynchronized read of state the new lock is meant to protect.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-27
Last Modified
2026-06-16
Generated
2026-06-16
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-46036
EUVD
EUVD-2026-32417
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.13 (inc) to 6.18.27 (exc)
linux linux_kernel From 6.19 (inc) to 7.0.4 (exc)
linux linux_kernel From 6.10 (inc) to 6.12.86 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's vfio/cdx component, where concurrent operations on device interrupts are not properly synchronized. Specifically, the function vfio_cdx_set_msi_trigger() reads and modifies interrupt-related data without serialization against concurrent VFIO_DEVICE_SET_IRQS ioctl calls. This can cause a race condition where one process sees the interrupt configuration as set while another clears it and frees related resources, leading to a use-after-free condition on the cdx_irqs array.

The fix involves adding a mutex lock (cdx_irqs_lock) to serialize access to the interrupt configuration and related data structures, ensuring atomicity and preventing the race condition.

Impact Analysis

This vulnerability can lead to a use-after-free condition in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges. Such exploitation could compromise the security and reliability of the affected system.

Mitigation Strategies

The vulnerability has been resolved by adding a per-device mutex to serialize VFIO_DEVICE_SET_IRQS operations in the Linux kernel. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Specifically, ensure your system is running a kernel version released after 2026-05-27 that contains the patch which adds the cdx_irqs_lock mutex to the vfio_cdx_device structure.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart