CVE-2026-97992

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the vhost-vdpa component of the Linux kernel. The function vhost vdpa config cb() loads the config ctx variable and signals it without holding a lock or taking a reference. Simultaneously, the VHOST VDPA SET CONFIG CALL ioctl can replace this field and trigger eventfd ctx put(), which immediately frees the context. Because these operations occur in different contexts (one under vhost dev.mutex and the other in an interrupt or workqueue context) without shared locking, a callback may dereference memory that has already been freed. This is reachable from userspace via /dev/vduse when a process injects config interrupts while another thread swaps the call file descriptor on the vhost-vdpa file descriptor.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.