CVE-2026-46036

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1

Description A use-after-free issue exists in the vfio/cdx component. The function vfio cdx set msi trigger() reads vdev->config msi and operates on the vdev->cdx irqs array without proper serialization against concurrent VFIO DEVICE SET IRQS ioctls. This allows a race condition where one caller observes config msi as set while another caller clears it and frees the cdx irqs array via vfio cdx msi disable(), leading to a use-after-free of the cdx irqs array.

Recommendations Update to version 7.0.11-1.1.