CVE-2026-97993 vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
A race condition in the Linux kernel vhost-vdpa driver allows a local attacker to cause a denial of service by triggering a null pointer dereference via a malformed file descriptor.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97993?
CVE-2026-97993 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
vhost_vdpa_set_config_call() swaps the eventfd_ctx_fdget() return value into v->config_ctx before checking it, so on failure the field briefly holds an ERR_PTR:
ctx = fd == VHOST_FILE_UNBIND ? NULL : eventfd_ctx_fdget(fd); swap(ctx, v->config_ctx);
if (!IS_ERR_OR_NULL(ctx)) eventfd_ctx_put(ctx);
if (IS_ERR(v->config_ctx)) { long ret = PTR_ERR(v->config_ctx);
v->config_ctx = NULL; return ret; }
Commit 0bde59c1723a ("vhost-vdpa: set v->config_ctx to NULL if eventfd_ctx_fdget() fails") added that clearing, and spelled out the invariant the rest of the file relies on: "we consider 'v->config_ctx' valid if it is not NULL". The window between the swap and the clearing still breaks it. vhost_vdpa_config_cb() only tests for NULL, so a config interrupt delivered inside the window hands the ERR_PTR to eventfd_signal().
Check the fd before installing it instead. That closes the window and matches how vhost_vring_ioctl() handles the same failure for the vq call fd.
It also stops a rejected fd from tearing down a config interrupt that was working: until now the swap replaced the live context and put it, so after an EBADF the device silently stopped delivering config interrupts until userspace installed a new fd.
Which versions are affected by CVE-2026-97993?
How do I fix CVE-2026-97993?
Apply the vendor's patch.
Is CVE-2026-97993 being exploited?
There is no known exploitation of CVE-2026-97993 in the wild and no public exploit code.
Sources
Also known as AZL-104534, BELL-CVE-2026-97993, DEBIAN-CVE-2026-97993, GHSA-g949-hj9j-pmpj, UBUNTU-CVE-2026-97993.