CVE-2026-97993

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx

vhost_vdpa_set_config_call() swaps the eventfd_ctx_fdget() return value

into v->config_ctx before checking it, so on failure the field briefly

holds an ERR_PTR:

ctx = fd == VHOST_FILE_UNBIND ? NULL : eventfd_ctx_fdget(fd);

swap(ctx, v->config_ctx);

if (!IS_ERR_OR_NULL(ctx))

eventfd_ctx_put(ctx);

if (IS_ERR(v->config_ctx)) {

long ret = PTR_ERR(v->config_ctx);

v->config_ctx = NULL;

return ret;

}

Commit 0bde59c1723a ("vhost-vdpa: set v->config_ctx to NULL if

eventfd_ctx_fdget() fails") added that clearing, and spelled out the

invariant the rest of the file relies on: "we consider 'v->config_ctx'

valid if it is not NULL". The window between the swap and the clearing

still breaks it. vhost_vdpa_config_cb() only tests for NULL, so a config

interrupt delivered inside the window hands the ERR_PTR to

eventfd_signal().

Check the fd befor

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References