CVE-2026-46034 - Vulnerability Details

- vfio/cdx: Fix NULL pointer dereference in interrupt trigger path

Description

In the Linux kernel, the following vulnerability has been resolved:

vfio/cdx: Fix NULL pointer dereference in interrupt trigger path

Add validation to ensure MSI is configured before accessing cdx_irqs
array in vfio_cdx_set_msi_trigger(). Without this check, userspace
can trigger a NULL pointer dereference by calling VFIO_DEVICE_SET_IRQS
with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before
ever setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD.

The vfio_cdx_msi_enable() function allocates the cdx_irqs array and
sets config_msi to 1 only when called through the EVENTFD path. The
trigger loop (for DATA_BOOL/DATA_NONE) assumed this had already been
done, but there was no enforcement of this call ordering.

This matches the protection used in the PCI VFIO driver where
vfio_pci_set_msi_trigger() checks irq_is() before the trigger loop.

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel VFIO/CDX driver contains a flaw that allows a NULL pointer dereference in the interrupt trigger loop. Userspace can invoke VFIO_DEVICE_SET_IRQS with the VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before properly configuring MSI through the EVENTFD path, causing the driver to dereference an uninitialized cdx_irqs array. The result is an uncontrolled kernel crash that can be used as a denial‑of‑service vector. This weakness is a classic NULL pointer dereference (CWE‑909).

Affected Systems

All Linux kernel releases that have not yet incorporated the patch commit referenced in the CVE description are affected. The vulnerability resides in the generic Linux kernel and is vendor‑neutral, affecting any distribution that ships the kernel unchanged. No specific version ranges are listed, so any pre‑patch kernel that exposes VFIO/CDX devices is potentially vulnerable.

Risk and Exploitability

The vulnerability is local; exploitation requires the ability to issue VFIO ioctl calls on a device that supports CDX. No public exploits are documented, and the EPSS score is not available. The patch adds validation and removes the prerequisite check, mitigating the issue. Because a kernel crash can lead to a reboot or a loss of service, the risk is considered high for any system that exposes vulnerable VFIO devices to untrusted users. The vulnerability is not listed in the CISA KEV catalog, indicating no widely known active exploitation yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`848e447e000c41894ff931dc7c004fd42c8840f8`	affected	< 51bf7638f33aece41cb3f4cbeb942cc52950e329
`848e447e000c41894ff931dc7c004fd42c8840f8`	affected	< 5d6c349c9823eb819fed8b537b088cf38126018c
`848e447e000c41894ff931dc7c004fd42c8840f8`	affected	< 338a736aaf15e8ba3635ce20b29af5b8fc15e66a
`848e447e000c41894ff931dc7c004fd42c8840f8`	affected	< 5ea5880764cbb164afb17a62e76ca75dc371409d

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`6.12.86`	unaffected	≤ 6.12.*
`6.18.27`	unaffected	≤ 6.18.*
`7.0.4`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[848e447e000c41894ff931dc7c004fd42c8840f8,51bf7638f33aece41cb3f4cbeb942cc52950e329)`	affected	code_commit	—
`[848e447e000c41894ff931dc7c004fd42c8840f8,5d6c349c9823eb819fed8b537b088cf38126018c)`	affected	code_commit	—
`[848e447e000c41894ff931dc7c004fd42c8840f8,338a736aaf15e8ba3635ce20b29af5b8fc15e66a)`	affected	code_commit	—
`[848e447e000c41894ff931dc7c004fd42c8840f8,5ea5880764cbb164afb17a62e76ca75dc371409d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.10`	affected	generic	—
`[0,6.10)`	unaffected	generic	—
`[6.12.86,6.13.0)`	unaffected	semver	—
`[6.18.27,6.19.0)`	unaffected	semver	—
`[7.0.4,7.1.0)`	unaffected	semver	—
`[7.1-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes the NULL pointer dereference check in vfio_cdx_set_msi_trigger, such as the latest upstream release or the vendor’s security update for your distribution.
If an immediate kernel update is not feasible, limit the use of VFIO/CDX devices by removing them from untrusted containers or applications, ensuring that only privileged processes can open these devices.
Verify that the VFIO driver is configured to require valid MSI configuration by setting appropriate access controls on the ioctl interfaces, and consider disabling the VFIO_DEVICE_SET_IRQS ioctl for devices that do not need dynamic interrupt configuration.

Generated by OpenCVE AI on May 28, 2026 at 04:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00122.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/338a736aaf15e8ba3635ce20b29af5b8fc15e66a
https://git.kernel.org/stable/c/51bf7638f33aece41cb3f4cbeb942cc52950e329
https://git.kernel.org/stable/c/5d6c349c9823eb819fed8b537b088cf38126018c
https://git.kernel.org/stable/c/5ea5880764cbb164afb17a62e76ca75dc371409d
https://lore.kernel.org/linux-cve-announce/2026052749-CVE-2026-46034-b4eb@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46034
https://www.cve.org/CVERecord?id=CVE-2026-46034

History

Tue, 16 Jun 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Thu, 28 May 2026 03:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Thu, 28 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-909
References		https://lore.kernel.org/linux-cve-announce/2026052749-CVE-2026-46034-b4eb@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46034 https://www.cve.org/CVERecord?id=CVE-2026-46034

Wed, 27 May 2026 21:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path Add validation to ensure MSI is configured before accessing cdx_irqs array in vfio_cdx_set_msi_trigger(). Without this check, userspace can trigger a NULL pointer dereference by calling VFIO_DEVICE_SET_IRQS with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before ever setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD. The vfio_cdx_msi_enable() function allocates the cdx_irqs array and sets config_msi to 1 only when called through the EVENTFD path. The trigger loop (for DATA_BOOL/DATA_NONE) assumed this had already been done, but there was no enforcement of this call ordering. This matches the protection used in the PCI VFIO driver where vfio_pci_set_msi_trigger() checks irq_is() before the trigger loop.
Title		vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/338a736aaf15e8ba3635ce20b29af5b8fc15e66a https://git.kernel.org/stable/c/51bf7638f33aece41cb3f4cbeb942cc52950e329 https://git.kernel.org/stable/c/5d6c349c9823eb819fed8b537b088cf38126018c https://git.kernel.org/stable/c/5ea5880764cbb164afb17a62e76ca75dc371409d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T12:56:43.389Z

Updated: 2026-06-14T17:49:29.082Z

Reserved: 2026-05-13T15:03:33.093Z

Link: CVE-2026-46034

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-27T14:17:22.463

Modified: 2026-06-16T16:59:26.720

Link: CVE-2026-46034

Redhat

Severity :

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-46034 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-28T05:00:08Z

Weaknesses

CWE-476
NULL Pointer Dereference
CWE-909
Missing Initialization of Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object