CVE-2026-46034 Overview
CVE-2026-46034 is a NULL pointer dereference vulnerability in the Linux kernel's vfio/cdx subsystem. The flaw resides in vfio_cdx_set_msi_trigger(), which fails to validate that Message Signaled Interrupts (MSI) are configured before accessing the cdx_irqs array. Userspace can trigger the dereference by issuing a VFIO_DEVICE_SET_IRQS ioctl with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before establishing interrupts through the VFIO_IRQ_SET_DATA_EVENTFD path. The result is a kernel crash and local denial of service against systems exposing CDX devices through VFIO.
Critical Impact
Local userspace processes with access to a VFIO/CDX device file can crash the kernel through an unvalidated ioctl call ordering, resulting in a denial of service.
Affected Products
- Linux kernel versions containing the vfio/cdx driver prior to the fix commits
- Stable kernel branches referenced by commits 338a736, 51bf763, 5d6c349, and 5ea5880
- Systems exposing Composable DMA Transport (CDX) devices to userspace via VFIO
Discovery Timeline
- 2026-05-27 - CVE-2026-46034 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46034
Vulnerability Analysis
The Linux kernel vfio/cdx driver exposes CDX devices to userspace for direct device assignment. Interrupt setup for these devices flows through vfio_cdx_set_msi_trigger(), which dispatches operations based on the flags field of the VFIO_DEVICE_SET_IRQS ioctl.
The vfio_cdx_msi_enable() helper allocates the cdx_irqs array and sets config_msi to 1, but only when invoked through the VFIO_IRQ_SET_DATA_EVENTFD code path. The trigger loop handling DATA_BOOL and DATA_NONE requests assumed MSI configuration had already occurred, yet no enforcement of this ordering existed in the driver.
When a local user calls the ioctl with DATA_BOOL or DATA_NONE before any EVENTFD setup, the code iterates over an unallocated cdx_irqs pointer. The dereference faults inside the kernel, producing a NULL pointer kernel oops.
Root Cause
The root cause is missing input validation [CWE-476] in the interrupt trigger path. The driver did not check whether config_msi was set before walking cdx_irqs. The PCI VFIO driver protects the equivalent operation by calling irq_is() before its trigger loop, and the fix ports the same guard pattern to the CDX backend.
Attack Vector
Exploitation requires local access and the ability to open a VFIO device file representing a CDX device. An attacker issues a single VFIO_DEVICE_SET_IRQS ioctl with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE before any eventfd-based interrupt is configured. The kernel then dereferences the unallocated cdx_irqs array, panicking the host or container. The attack does not yield code execution but reliably crashes the running kernel.
No verified public proof-of-concept code is associated with this CVE. The patch commits referenced by the kernel.org stable tree describe the corrective check rather than an exploit primitive.
Detection Methods for CVE-2026-46034
Indicators of Compromise
- Kernel oops messages referencing vfio_cdx_set_msi_trigger or NULL pointer dereferences originating from the vfio/cdx module
- Unexpected host or guest crashes on systems that assign CDX devices to userspace workloads
- dmesg traces containing BUG: kernel NULL pointer dereference with cdx_irqs symbols in the backtrace
Detection Strategies
- Audit VFIO_DEVICE_SET_IRQS ioctl invocations against /dev/vfio/* device files using auditd or eBPF tracing
- Flag processes that issue DATA_BOOL or DATA_NONE flag combinations without a prior DATA_EVENTFD configuration on the same device file descriptor
- Correlate kernel panic events with the running kernel version to identify unpatched hosts
Monitoring Recommendations
- Forward kernel logs and crash dumps to a centralized logging system and alert on vfio_cdx stack traces
- Track which workloads hold open file descriptors to VFIO device nodes and restrict that capability to vetted processes
- Monitor kernel package state across the fleet to detect hosts running pre-patch versions of the vfio/cdx driver
How to Mitigate CVE-2026-46034
Immediate Actions Required
- Apply the stable kernel updates containing commits 338a736aaf15, 51bf7638f33a, 5d6c349c9823, or 5ea5880764cb from the upstream Linux stable tree
- Restrict access to /dev/vfio/* device nodes to trusted users and service accounts only
- Reboot affected hosts after kernel package updates to ensure the patched module is loaded
Patch Information
The fix adds a validation step to vfio_cdx_set_msi_trigger() that confirms MSI has been configured before accessing the cdx_irqs array. The corrective commits are published in the upstream stable tree: Kernel Git Commit 338a736, Kernel Git Commit 51bf763, Kernel Git Commit 5d6c349, and Kernel Git Commit 5ea5880. Distribution vendors are expected to backport the change to supported long-term kernels.
Workarounds
- Unload or blacklist the vfio_cdx kernel module on systems that do not require CDX device passthrough
- Remove user accounts from groups that grant access to /dev/vfio/* until the patched kernel is deployed
- Use mandatory access control policies such as SELinux or AppArmor to deny ioctl access to VFIO device nodes for untrusted processes
# Verify whether the vfio_cdx module is loaded
lsmod | grep vfio_cdx
# Temporarily unload the module if CDX passthrough is not required
sudo modprobe -r vfio_cdx
# Persistently blacklist the module
echo "blacklist vfio_cdx" | sudo tee /etc/modprobe.d/blacklist-vfio-cdx.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
