PT-2026-43901 · Linux · Linux

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-46034

Mitre

In the Linux kernel, the following vulnerability has been resolved:

vfio/cdx: Fix NULL pointer dereference in interrupt trigger path

Add validation to ensure MSI is configured before accessing cdx irqs array in vfio cdx set msi trigger(). Without this check, userspace can trigger a NULL pointer dereference by calling VFIO DEVICE SET IRQS with VFIO IRQ SET DATA BOOL or VFIO IRQ SET DATA NONE flags before ever setting up interrupts via VFIO IRQ SET DATA EVENTFD.

The vfio cdx msi enable() function allocates the cdx irqs array and sets config msi to 1 only when called through the EVENTFD path. The trigger loop (for DATA BOOL/DATA NONE) assumed this had already been done, but there was no enforcement of this call ordering.

This matches the protection used in the PCI VFIO driver where vfio pci set msi trigger() checks irq is() before the trigger loop.

Related Identifiers

CVE-2026-46034

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-46034 · Security Note
• https://git.kernel.org/stable/c/5d6c349c9823eb819fed8b537b088cf38126018c · Note
• https://git.kernel.org/stable/c/51bf7638f33aece41cb3f4cbeb942cc52950e329 · Note
• https://git.kernel.org/stable/c/5ea5880764cbb164afb17a62e76ca75dc371409d · Note
• https://git.kernel.org/stable/c/338a736aaf15e8ba3635ce20b29af5b8fc15e66a · Note