PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46034 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's VFIO CDX driver. The flaw occurs in vfio_cdx_set_msi_trigger() when userspace invokes VFIO_DEVICE_SET_IRQS with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before configuring MSI interrupts via VFIO_IRQ_SET_DATA_EVENTFD. The cdx_irqs array is only allocated and config_msi set to 1 when vfio_cdx_msi_enable() is called through the EVENTFD path, but the trigger loop assumed this initialization had already occurred without enforcing proper call ordering. The fix adds validation to ensure MSI is configured before accessing the cdx_irqs array, matching the protection pattern used in the PCI VFIO driver.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Organizations running Linux kernels with VFIO CDX support enabled, particularly those using CDX (Compute Express Link) devices with VFIO passthrough in virtualized or containerized environments.

Technical summary

The vulnerability is a NULL pointer dereference in the VFIO CDX driver's MSI interrupt handling. The cdx_irqs array is allocated only when MSI is enabled via the EVENTFD path, but the trigger path for DATA_BOOL/DATA_NONE flags did not verify this precondition. Userspace could trigger the dereference by calling VFIO_DEVICE_SET_IRQS with trigger flags before proper MSI setup. The fix adds a config_msi check before the trigger loop, consistent with the PCI VFIO driver's vfio_pci_set_msi_trigger() implementation.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable tree commits when available for your distribution
  • Verify VFIO CDX driver is not exposed to untrusted userspace if patching is delayed
  • Monitor distribution security advisories for backported fixes
  • Review VFIO device access controls to limit exposure to privileged users only

Evidence notes

CVE published 2026-05-27T14:17:22.463Z; modified 2026-05-27T14:48:03.013Z. Four kernel.org stable tree commits provided as references. No CVSS score or severity assigned by NVD at time of disclosure; status 'Awaiting Analysis'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46034 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46034

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46034 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46034

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/338a736aaf15e8ba3635ce20b29af5b8fc15e66a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/51bf7638f33aece41cb3f4cbeb942cc52950e329

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5d6c349c9823eb819fed8b537b088cf38126018c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5ea5880764cbb164afb17a62e76ca75dc371409d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.