CVE-2026-97993

Overview

A flaw in the Linux kernel’s vhost‑vdpa driver allows a temporary invalid eventfd context to be used during configuration changes, potentially causing config interrupts to fail silently. The issue arises from a race window between swapping the context and clearing an error value. It affects systems running the vhost‑vdpa driver in the kernel.

Description

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx vhost_vdpa_set_config_call() swaps the eventfd_ctx_fdget() return value into v->config_ctx before checking it, so on failure the field briefly holds an ERR_PTR: ctx = fd == VHOST_FILE_UNBIND ? NULL : eventfd_ctx_fdget(fd); swap(ctx, v->config_ctx); if (!IS_ERR_OR_NULL(ctx)) eventfd_ctx_put(ctx); if (IS_ERR(v->config_ctx)) { long ret = PTR_ERR(v->config_ctx); v->config_ctx = NULL; return ret; } Commit 0bde59c1723a ("vhost-vdpa: set v->config_ctx to NULL if eventfd_ctx_fdget() fails") added that clearing, and spelled out the invariant the rest of the file relies on: "we consider 'v->config_ctx' valid if it is not NULL". The window between the swap and the clearing still breaks it. vhost_vdpa_config_cb() only tests for NULL, so a config interrupt delivered inside the window hands the ERR_PTR to eventfd_signal(). Check the fd before installing it instead. That closes the window and matches how vhost_vring_ioctl() handles the same failure for the vq call fd. It also stops a rejected fd from tearing down a config interrupt that was working: until now the swap replaced the live context and put it, so after an EBADF the device silently stopped delivering config interrupts until userspace installed a new fd.

Impact

The vulnerability can lead to denial of service by interrupting configuration updates, disrupting virtual device operation. It does not provide direct code execution or data exfiltration. Defenders may notice missed config interrupts or degraded performance in virtualized environments.

Remediation

Apply the kernel patch that clears v->config_ctx on eventfd_ctx_fdget() failure (commit 0bde59c1723a). Update to the latest kernel release or backport the fix. If the driver is not required, disable vhost‑vdpa or block its module loading. Monitor kernel logs for "vhost_vdpa" related errors and ensure eventfd file descriptors are valid.

Risk context

The CVE has a medium severity score (CVSS 5.5) and no EPSS data. While it does not enable remote code execution, it can cause service disruption in virtualized environments. Defenders should treat it as a moderate risk and apply the patch promptly.

Affected products

• Linux kernel
• vhost‑vdpa driver
• vhost module