CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
In the Linux kernel, the following vulnerability has been resolved:
vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
Add validation to ensure MSI is configured before accessing cdxirqs array in vfiocdxsetmsitrigger(). Without this check, userspace can trigger a NULL pointer dereference by calling VFIODEVICESETIRQS with VFIOIRQSETDATABOOL or VFIOIRQSETDATANONE flags before ever setting up interrupts via VFIOIRQSETDATAEVENTFD.
The vfiocdxmsienable() function allocates the cdxirqs array and sets configmsi to 1 only when called through the EVENTFD path. The trigger loop (for DATABOOL/DATANONE) assumed this had already been done, but there was no enforcement of this call ordering.
This matches the protection used in the PCI VFIO driver where vfiopcisetmsitrigger() checks irqis() before the trigger loop.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify vfio_cdx_set_msi_trigger() to verify MSI is configured (e.g., check config_msi or irq_is()) before accessing the cdx_irqs array, matching the protection used by vfio_pci_set_msi_trigger().
vfio/cdx kernel driver validate MSI configured before accessing cdx_irqs = enabled - Compensating control
Until the kernel is patched, restrict which processes/users can access the VFIO device nodes (for example by adjusting device node permissions, using cgroups, or SELinux/AppArmor policies) so untrusted users cannot issue VFIO_DEVICE_SET_IRQS ioctls.
- Operational
Ensure userspace callers do not invoke VFIO_DEVICE_SET_IRQS with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE before setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD; update affected userspace code to perform the EVENTFD (interrupt setup) path first.