PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46036 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's VFIO CDX (Compute Express Link) driver. The flaw occurs in vfio_cdx_set_msi_trigger() where concurrent VFIO_DEVICE_SET_IRQS ioctls can race: one thread observes vdev->config_msi as set while another clears it and frees vdev->cdx_irqs via vfio_cdx_msi_disable(), leading to use-after-free of the cdx_irqs array. The fix introduces a per-device cdx_irqs_lock mutex to serialize all updates to config_msi, cdx_irqs, and msi_count through the single chokepoint vfio_cdx_set_msi_trigger(), covering both ioctl paths and close-device cleanup. The vulnerability was resolved on 2026-05-27. No CVSS score or severity has been assigned; the CVE status is Awaiting Analysis.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Organizations running Linux kernels with VFIO CDX support enabled, particularly those using device passthrough for virtualization or confidential computing workloads with untrusted guests. Cloud providers and enterprises with PCI/PCIe device assignment to VMs should prioritize patching.

Technical summary

The VFIO CDX driver in the Linux kernel lacked proper synchronization when handling VFIO_DEVICE_SET_IRQS ioctls. The vfio_cdx_set_msi_trigger() function reads vdev->config_msi and operates on vdev->cdx_irqs without serialization against concurrent ioctls. This race condition enables one thread to observe config_msi as set while another clears it and frees cdx_irqs, resulting in use-after-free. The fix adds a cdx_irqs_lock mutex to struct vfio_cdx_device, acquired in vfio_cdx_set_msi_trigger() to atomically protect config_msi tests and subsequent enable/disable/trigger operations across both ioctl and cleanup paths.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches once available for your distribution
  • Verify vfio_cdx driver is not loaded on systems where CDX/PCIe device passthrough is not required
  • Monitor vendor security advisories for backported fixes to long-term support kernels
  • Review systems using VFIO for device passthrough to untrusted workloads as potential attack surface

Evidence notes

Vulnerability description and fix details sourced from official CVE record and NVD entry. Patch commits referenced in source metadata confirm the mutex-based serialization fix. No KEV listing or known ransomware campaign use identified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46036 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46036

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46036 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46036

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/670e8864b1a218d72f08db40d0103adf38fa1d9b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7530f34ec0ca1438d45a75dcb43183a1cc92eced

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7b436ade16cc81095d79b79f8efa3af0a4f5c5a2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ddf96e23c366c566283fce8377928851fa7f5e81

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.