CVE-2026-46036
Description
A flaw was found in the Linux kernel's vfio/cdx component. A race condition can occur during concurrent VFIO_DEVICE_SET_IRQS ioctls (input/output control calls), specifically within the vfio_cdx_set_msi_trigger() function. This allows two callers to interact in a way that leads to a use-after-free vulnerability of the cdx_irqs array. A local attacker could exploit this to cause a denial of service or potentially achieve privilege escalation.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
