Cloudanix VulnDB

CVE-2026-46034

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

May 27, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel can let a local user crash the whole computer by sending certain device commands in the wrong order.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

NULL pointer dereference in vfio_cdx_set_msi_trigger() when VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE is supplied before vfio_cdx_msi_enable() has allocated the cdx_irqs array and set config_msi.

Why it matters to the business

Local users can crash the kernel on affected systems, causing denial of service and loss of availability for workloads that rely on the CDX VFIO driver.

How an attack unfolds

An attacker with local access and permission to open a VFIO device issues VFIO_DEVICE_SET_IRQS ioctls using DATA_BOOL or DATA_NONE flags before any EVENTFD-based MSI setup has occurred; the missing check allows dereference of an uninitialized pointer, triggering a kernel oops.

How to fix it

Upgrade the Linux kernel to a version containing the upstream fix that adds the irq_is() style validation in vfio_cdx_set_msi_trigger() before the trigger loop.

How to confirm the fix worked

Confirm the presence of the validation check that guards access to cdx_irqs with config_msi in vfio_cdx_set_msi_trigger(); test that out-of-order VFIO_IRQ_SET_DATA_* calls no longer panic the kernel.

Typical attack path

  1. Obtain local shell or process with access to /dev/vfio/* for a CDX device
  2. Open the VFIO device file descriptor
  3. Call VFIO_DEVICE_SET_IRQS with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE before any VFIO_IRQ_SET_DATA_EVENTFD call
  4. Trigger kernel NULL dereference and system crash

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log) for oops or panic messages referencing vfio_cdx_set_msi_trigger or NULL dereference during VFIO ioctls; correlate with processes performing VFIO_DEVICE_SET_IRQS calls before MSI setup.

What your security team should do

  • Prioritize kernel updates on systems exposing VFIO CDX devices to untrusted local users
  • Restrict VFIO device access via device permissions and SELinux/AppArmor policies until patched
  • Monitor kernel logs for NULL pointer dereference oops involving vfio_cdx_set_msi_trigger

The record

In the Linux kernel, the following vulnerability has been resolved: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Add validation to ensure MSI is configured before accessing cdx_irqs array in vfio_cdx_set_msi_trigger(). Without this check, userspace can trigger a NULL pointer dereference by calling VFIO_DEVICE_SET_IRQS with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before ever setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD. The vfio_cdx_msi_enable() function allocates the cdx_irqs array and sets config_msi to 1 only when called through the EVENTFD path. The trigger loop (for DATA_BOOL/DATA_NONE) assumed this had already been done, but there was no enforcement of this call ordering. This matches the protection used in the PCI VFIO driver where vfio_pci_set_msi_trigger() checks irq_is() before the trigger loop.

Affected packages

Ecosystem Package Introduced Fixed
openSUSE:Tumbleweed kernel-source 0 7.0.11-1.1

Related vulnerabilities