CVE-2026-46036

In the Linux kernel, the following vulnerability has been resolved:

vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex

vfio_cdx_set_msi_trigger() reads vdev->config_msi and operates on the

vdev->cdx_irqs array based on its value, but provides no serialization

against concurrent VFIO_DEVICE_SET_IRQS ioctls. Two callers can race

such that one observes config_msi as set while another clears it and

frees cdx_irqs via vfio_cdx_msi_disable(), resulting in a use-after-free

of the cdx_irqs array.

Add a cdx_irqs_lock mutex to struct vfio_cdx_device and acquire it in

vfio_cdx_set_msi_trigger(), which is the single chokepoint through

which all updates to config_msi, cdx_irqs, and msi_count flow, covering

both the ioctl path and the close-device cleanup path. This keeps the

test of config_msi atomic with the subsequent enable, disable, or

trigger operations.

Drop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() as part

of this change: the optimization it provided is redundant with the

!config_msi early-return inside vfio_cdx_msi_disable(), and leaving the

test in place would be an unsynchronized read of state the new lock is

meant to protect.