CVE-2026-97993 (GCVE-0-2026-97993)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-19 09:12
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx vhost_vdpa_set_config_call() swaps the eventfd_ctx_fdget() return value into v->config_ctx before checking it, so on failure the field briefly holds an ERR_PTR: ctx = fd == VHOST_FILE_UNBIND ? NULL : eventfd_ctx_fdget(fd); swap(ctx, v->config_ctx); if (!IS_ERR_OR_NULL(ctx)) eventfd_ctx_put(ctx); if (IS_ERR(v->config_ctx)) { long ret = PTR_ERR(v->config_ctx); v->config_ctx = NULL; return ret; } Commit 0bde59c1723a ("vhost-vdpa: set v->config_ctx to NULL if eventfd_ctx_fdget() fails") added that clearing, and spelled out the invariant the rest of the file relies on: "we consider 'v->config_ctx' valid if it is not NULL". The window between the swap and the clearing still breaks it. vhost_vdpa_config_cb() only tests for NULL, so a config interrupt delivered inside the window hands the ERR_PTR to eventfd_signal(). Check the fd before installing it instead. That closes the window and matches how vhost_vring_ioctl() handles the same failure for the vq call fd. It also stops a rejected fd from tearing down a config interrupt that was working: until now the swap replaced the live context and put it, so after an EBADF the device silently stopped delivering config interrupts until userspace installed a new fd.
References
Impacted products
Vendor Product Version
Linux Linux Version: 776f395004d829bbbf18c159ed9beb517a208c71
Version: 776f395004d829bbbf18c159ed9beb517a208c71
Version: 776f395004d829bbbf18c159ed9beb517a208c71
Version: 776f395004d829bbbf18c159ed9beb517a208c71
Version: 776f395004d829bbbf18c159ed9beb517a208c71
Version: 776f395004d829bbbf18c159ed9beb517a208c71
Version: 776f395004d829bbbf18c159ed9beb517a208c71
Version: 776f395004d829bbbf18c159ed9beb517a208c71
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/vdpa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e260dc9fbfdae0978e7a8698f977fbb463a657be",
              "status": "affected",
              "version": "776f395004d829bbbf18c159ed9beb517a208c71",
              "versionType": "git"
            },
            {
              "lessThan": "66e73fa18910b39fea0941dea5fe091122240855",
              "status": "affected",
              "version": "776f395004d829bbbf18c159ed9beb517a208c71",
              "versionType": "git"
            },
            {
              "lessThan": "4fde085eb839fbb39c25cbba5d2a091ded394877",
              "status": "affected",
              "version": "776f395004d829bbbf18c159ed9beb517a208c71",
              "versionType": "git"
            },
            {
              "lessThan": "59fc7c1c6b4d325194ca45352180340092d95098",
              "status": "affected",
              "version": "776f395004d829bbbf18c159ed9beb517a208c71",
              "versionType": "git"
            },
            {
              "lessThan": "388c678639a0cebfd936b3e56c64ac6a371efec2",
              "status": "affected",
              "version": "776f395004d829bbbf18c159ed9beb517a208c71",
              "versionType": "git"
            },
            {
              "lessThan": "65faf9eaa00e408e1406fbcf675c8c8d0e27ff2a",
              "status": "affected",
              "version": "776f395004d829bbbf18c159ed9beb517a208c71",
              "versionType": "git"
            },
            {
              "lessThan": "6b20b40f020bde236f6b8a08ff88d8653261ec2b",
              "status": "affected",
              "version": "776f395004d829bbbf18c159ed9beb517a208c71",
              "versionType": "git"
            },
            {
              "lessThan": "e74a9fa50749b9940b4fb13199652325e08d3c4a",
              "status": "affected",
              "version": "776f395004d829bbbf18c159ed9beb517a208c71",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/vdpa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: don\u0027t install the eventfd_ctx_fdget() error in config_ctx\n\nvhost_vdpa_set_config_call() swaps the eventfd_ctx_fdget() return value\ninto v-\u003econfig_ctx before checking it, so on failure the field briefly\nholds an ERR_PTR:\n\n\tctx = fd == VHOST_FILE_UNBIND ? NULL : eventfd_ctx_fdget(fd);\n\tswap(ctx, v-\u003econfig_ctx);\n\n\tif (!IS_ERR_OR_NULL(ctx))\n\t\teventfd_ctx_put(ctx);\n\n\tif (IS_ERR(v-\u003econfig_ctx)) {\n\t\tlong ret = PTR_ERR(v-\u003econfig_ctx);\n\n\t\tv-\u003econfig_ctx = NULL;\n\t\treturn ret;\n\t}\n\nCommit 0bde59c1723a (\"vhost-vdpa: set v-\u003econfig_ctx to NULL if\neventfd_ctx_fdget() fails\") added that clearing, and spelled out the\ninvariant the rest of the file relies on: \"we consider \u0027v-\u003econfig_ctx\u0027\nvalid if it is not NULL\".  The window between the swap and the clearing\nstill breaks it.  vhost_vdpa_config_cb() only tests for NULL, so a config\ninterrupt delivered inside the window hands the ERR_PTR to\neventfd_signal().\n\nCheck the fd before installing it instead.  That closes the window and\nmatches how vhost_vring_ioctl() handles the same failure for the vq call\nfd.\n\nIt also stops a rejected fd from tearing down a config interrupt that was\nworking: until now the swap replaced the live context and put it, so\nafter an EBADF the device silently stopped delivering config interrupts\nuntil userspace installed a new fd."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:12:00.172Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e260dc9fbfdae0978e7a8698f977fbb463a657be"
        },
        {
          "url": "https://git.kernel.org/stable/c/66e73fa18910b39fea0941dea5fe091122240855"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fde085eb839fbb39c25cbba5d2a091ded394877"
        },
        {
          "url": "https://git.kernel.org/stable/c/59fc7c1c6b4d325194ca45352180340092d95098"
        },
        {
          "url": "https://git.kernel.org/stable/c/388c678639a0cebfd936b3e56c64ac6a371efec2"
        },
        {
          "url": "https://git.kernel.org/stable/c/65faf9eaa00e408e1406fbcf675c8c8d0e27ff2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b20b40f020bde236f6b8a08ff88d8653261ec2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e74a9fa50749b9940b4fb13199652325e08d3c4a"
        }
      ],
      "title": "vhost-vdpa: don\u0027t install the eventfd_ctx_fdget() error in config_ctx",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97993",
    "datePublished": "2026-09-25T10:23:25.110Z",
    "dateReserved": "2026-09-25T10:18:58.209Z",
    "dateUpdated": "2026-10-19T09:12:00.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.