The linux kernel vfio‑cdx driver contains a race condition in which two concurrent VFIO_DEVICE_SET_IRQS ioctl calls can trigger a use‑after‑free of the cdx_irqs array. One thread reads config_msi as set while another thread clears it and frees the array in vfio_cdx_msi_disable(), leaving a stale reference that can be used during subsequent trigger or enable operations. This flaw involves a lack of serialization (CWE‑820) that can lead to kernel memory corruption and potentially arbitrary code execution in kernel mode.

All linux_kernel releases that lack the per‑device cdx_irqs_lock mutex introduced by the patch in commit 670e8864b1a218d72f08db40d0103adf38fa1d9b are affected. This includes the default kernel on most distributions before that commit. The CVE does not specify precise version ranges, so any instance of the vulnerable code path is at risk.

The EPSS score is not available and the issue is not listed in the CISA KEV catalog, implying no known public exploitation at the time of this analysis. Exploitation would require the ability to issue VFIO_DEVICE_SET_IRQS ioctl commands to a valid VFIO device and to perform the two calls concurrently. Because access to VFIO devices is normally restricted to privileged users, the likelihood of successful exploitation is limited, however the severity of the potential kernel corruption warrants prompt attention.