CVE-2026-46036: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46036 Overview

CVE-2026-46036 is a use-after-free race condition in the Linux kernel's vfio/cdx subsystem. The flaw resides in vfio_cdx_set_msi_trigger(), which reads vdev->config_msi and operates on the vdev->cdx_irqs array without serialization against concurrent VFIO_DEVICE_SET_IRQS ioctls. Two callers can race such that one observes config_msi as set while another clears it and frees cdx_irqs via vfio_cdx_msi_disable(). The result is a use-after-free of the cdx_irqs array. The vulnerability has been resolved upstream by introducing a per-device mutex that serializes all updates to config_msi, cdx_irqs, and msi_count.

Critical Impact
Concurrent VFIO_DEVICE_SET_IRQS ioctl calls can trigger a use-after-free in kernel memory, leading to potential privilege escalation or kernel memory corruption.

Affected Products

Linux kernel versions containing the vfio/cdx driver prior to the patch commits
Systems exposing the Composable DMA-capable (CDX) bus through VFIO to userspace
Linux distributions shipping affected stable kernel branches

Discovery Timeline

2026-05-27 - CVE-2026-46036 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46036

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] leading to a use-after-free [CWE-416] in the Linux kernel's VFIO CDX bus driver. The function vfio_cdx_set_msi_trigger() acts as the central path for MSI (Message Signaled Interrupt) configuration, but it lacks synchronization between concurrent userspace ioctl invocations. When two threads issue VFIO_DEVICE_SET_IRQS ioctls simultaneously, one thread can read vdev->config_msi as true while another thread clears that flag and frees the cdx_irqs array through vfio_cdx_msi_disable(). The first thread then dereferences the freed array.

The upstream fix adds a cdx_irqs_lock mutex to struct vfio_cdx_device. The mutex is acquired in vfio_cdx_set_msi_trigger(), ensuring that the test of config_msi remains atomic with the subsequent enable, disable, or trigger operations. The fix covers both the ioctl path and the close-device cleanup path.

Root Cause

The root cause is missing serialization around shared mutable state. The config_msi flag, the cdx_irqs array, and the msi_count field are accessed and modified without holding a lock. The original code relied on implicit ordering assumptions that do not hold when multiple userspace threads invoke ioctls on the same VFIO file descriptor concurrently.

Attack Vector

Exploitation requires local access to a system where a process can open a VFIO CDX device file descriptor. An attacker with the required capability issues concurrent VFIO_DEVICE_SET_IRQS ioctls from multiple threads. By timing the calls to interleave enable and disable operations, the attacker triggers the race and gains a use-after-free condition on a kernel slab allocation. Use-after-free conditions in kernel memory can be leveraged for kernel information disclosure or privilege escalation depending on slab reuse primitives available to the attacker.

No verified public exploit code is available. Refer to the upstream commits for technical fix details: Kernel Commit 7b436ade16cc.

Detection Methods for CVE-2026-46036

Indicators of Compromise

Unexpected kernel oops or panic messages referencing vfio_cdx_set_msi_trigger, vfio_cdx_msi_disable, or the cdx_irqs array in dmesg output.
KASAN (Kernel Address Sanitizer) reports flagging use-after-free events in the vfio/cdx code path on instrumented kernels.
Repeated VFIO_DEVICE_SET_IRQS ioctl calls from a single process across multiple threads against a CDX device.

Detection Strategies

Audit auditd logs for processes opening /dev/vfio/* devices and issuing high-frequency ioctl calls.
Enable CONFIG_KASAN on test kernels to surface use-after-free conditions during fuzzing of the VFIO ioctl surface.
Correlate kernel crash telemetry with userspace process ancestry to identify unprivileged processes interacting with VFIO interfaces.

Monitoring Recommendations

Monitor kernel ring buffer for KASAN, SLUB, or general protection fault messages tied to VFIO call stacks.
Track which workloads legitimately require VFIO CDX access and alert on unexpected processes opening these device nodes.
Forward kernel logs to a centralized analytics pipeline to correlate kernel anomalies with process activity across hosts.

How to Mitigate CVE-2026-46036

Immediate Actions Required

Apply the upstream Linux kernel patches that introduce the cdx_irqs_lock mutex in struct vfio_cdx_device.
Update to a distribution kernel that has backported the fix from the referenced stable branches.
Restrict access to /dev/vfio/* device nodes to trusted users and processes through filesystem permissions and Linux capabilities.

Patch Information

The vulnerability is resolved by the following upstream commits, which add a per-device mutex and remove the now-redundant unsynchronized !cdx_irqs test from vfio_cdx_irqs_cleanup():

Workarounds

Disable or unload the vfio_cdx kernel module on systems that do not require CDX device passthrough.
Constrain VFIO access using udev rules and group membership so that only privileged service accounts can open CDX device nodes.
Apply seccomp filters to workloads that should never issue VFIO_DEVICE_SET_IRQS ioctls.

bash

# Configuration example: restrict VFIO CDX device access
# Unload module if CDX passthrough is not required
sudo modprobe -r vfio_cdx

# Blacklist the module to prevent automatic loading
echo "blacklist vfio_cdx" | sudo tee /etc/modprobe.d/blacklist-vfio-cdx.conf

# Verify current kernel version against patched releases
uname -r