{"cve":"CVE-2026-46036","nvd":{"published":"2026-05-27T14:17:22.913","modified":"2026-06-17T10:52:56.477","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex\n\nvfio_cdx_set_msi_trigger() reads vdev->config_msi and operates on the\nvdev->cdx_irqs array based on its value, but provides no serialization\nagainst concurrent VFIO_DEVICE_SET_IRQS ioctls.  Two callers can race\nsuch that one observes config_msi as set while another clears it and\nfrees cdx_irqs via vfio_cdx_msi_disable(), resulting in a use-after-free\nof the cdx_irqs array.\n\nAdd a cdx_irqs_lock mutex to struct vfio_cdx_device and acquire it in\nvfio_cdx_set_msi_trigger(), which is the single chokepoint through\nwhich all updates to config_msi, cdx_irqs, and msi_count flow, covering\nboth the ioctl path and the close-device cleanup path.  This keeps the\ntest of config_msi atomic with the subsequent enable, disable, or\ntrigger operations.\n\nDrop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() as part\nof this change: the optimization it provided is redundant with the\n!config_msi early-return inside vfio_cdx_msi_disable(), and leaving the\ntest in place would be an unsynchronized read of state the new lock is\nmeant to protect.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/670e8864b1a218d72f08db40d0103adf38fa1d9b","https://git.kernel.org/stable/c/7530f34ec0ca1438d45a75dcb43183a1cc92eced","https://git.kernel.org/stable/c/7b436ade16cc81095d79b79f8efa3af0a4f5c5a2","https://git.kernel.org/stable/c/ddf96e23c366c566283fce8377928851fa7f5e81"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:36:28.938604137+00:00"},"epss":{"cve":"CVE-2026-46036","score":0.00139,"percentile":0.03224,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}