CVE-2026-97993: vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx

In the Linux kernel, the following vulnerability has been resolved:

vhost-vdpa: don't install the eventfdctxfdget() error in configctx

vhostvdpasetconfigcall() swaps the eventfdctxfdget() return value into v->configctx before checking it, so on failure the field briefly holds an ERRPTR:

ctx = fd == VHOSTFILEUNBIND ? NULL : eventfdctxfdget(fd); swap(ctx, v->configctx);

if (!ISERRORNULL(ctx)) eventfdctxput(ctx);

if (ISERR(v->configctx)) { long ret = PTRERR(v->configctx);

v->configctx = NULL; return ret; }

Commit 0bde59c1723a ("vhost-vdpa: set v->configctx to NULL if eventfdctxfdget() fails") added that clearing, and spelled out the invariant the rest of the file relies on: "we consider 'v->configctx' valid if it is not NULL". The window between the swap and the clearing still breaks it. vhostvdpaconfigcb() only tests for NULL, so a config interrupt delivered inside the window hands the ERRPTR to eventfdsignal().

Check the fd before installing it instead. That closes the window and matches how vhostvringioctl() handles the same failure for the vq call fd.

It also stops a rejected fd from tearing down a config interrupt that was working: until now the swap replaced the live context and put it, so after an EBADF the device silently stopped delivering config interrupts until userspace installed a new fd.