CVE-2026-46034

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1

Description A NULL pointer dereference exists in the interrupt trigger path of the vfio/cdx module. The vfio cdx set msi trigger() function fails to validate if Message Signaled Interrupts (MSI) are configured before accessing the cdx irqs array. Userspace can trigger this issue by calling the 'VFIO DEVICE SET IRQS' endpoint with VFIO IRQ SET DATA BOOL or VFIO IRQ SET DATA NONE flags before interrupts are established via VFIO IRQ SET DATA EVENTFD. This occurs because the vfio cdx msi enable() function, which allocates the cdx irqs array and sets config msi to 1, is only executed through the EVENTFD path, and there was no enforcement of the call ordering.

Recommendations Update to version 7.0.11-1.1.