CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
In the Linux kernel, the following vulnerability has been resolved:
vfio/cdx: Serialize VFIODEVICESETIRQS with a per-device mutex
vfiocdxsetmsitrigger() reads vdev->configmsi and operates on the vdev->cdxirqs array based on its value, but provides no serialization against concurrent VFIODEVICESETIRQS ioctls. Two callers can race such that one observes configmsi as set while another clears it and frees cdxirqs via vfiocdxmsidisable(), resulting in a use-after-free of the cdxirqs array.
Add a cdxirqslock mutex to struct vfiocdxdevice and acquire it in vfiocdxsetmsitrigger(), which is the single chokepoint through which all updates to configmsi, cdxirqs, and msicount flow, covering both the ioctl path and the close-device cleanup path. This keeps the test of configmsi atomic with the subsequent enable, disable, or trigger operations.
Drop the pre-call !cdxirqs test from vfiocdxirqscleanup() as part of this change: the optimization it provided is redundant with the !configmsi early-return inside vfiocdxmsidisable(), and leaving the test in place would be an unsynchronized read of state the new lock is meant to protect.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In vfio/cdx, add a cdx_irqs_lock mutex to struct vfio_cdx_device, acquire it in the IRQ enable/disable path (vfio_cdx_msi_disable()), and serialize related operations between VFIO_DEVICE_SET_IRQS ioctl handling and close-device cleanup to prevent concurrent free/use of cdx_irqs. As part of this change, drop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() so state is handled under the new lock.
Linux kernel vfio/cdx vfio/cdx_irqs synchronization = add per-device cdx_irqs_lock mutex and use it