CVE-2026-46034 vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
A local attacker can cause a kernel crash by triggering a NULL pointer dereference in the VFIO CDX driver via improper interrupt configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46034?
CVE-2026-46034 is a medium-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vfio/cdx: Fix NULL pointer dereference in interrupt trigger path
Add validation to ensure MSI is configured before accessing cdx_irqs array in vfio_cdx_set_msi_trigger(). Without this check, userspace can trigger a NULL pointer dereference by calling VFIO_DEVICE_SET_IRQS with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before ever setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD.
The vfio_cdx_msi_enable() function allocates the cdx_irqs array and sets config_msi to 1 only when called through the EVENTFD path. The trigger loop (for DATA_BOOL/DATA_NONE) assumed this had already been done, but there was no enforcement of this call ordering.
This matches the protection used in the PCI VFIO driver where vfio_pci_set_msi_trigger() checks irq_is() before the trigger loop.
Weakness: CWE-476
Which versions are affected by CVE-2026-46034?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46034?
Apply the vendor's patch.
Is CVE-2026-46034 being exploited?
There is no known exploitation of CVE-2026-46034 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-46034, DEBIAN-CVE-2026-46034, GHSA-cj6g-rrgh-rx3w, UBUNTU-CVE-2026-46034.