CVE-2026-97992

A flaw was found in the Linux kernel's vhost-vdpa driver. A race condition between device configuration updates and event notifications allows a context structure to be freed while still being accessed by an active callback. A local user with access to the device interface can exploit this use-after-free vulnerability to cause memory corruption, leading to a system crash and Denial of Service (DoS), or potentially escalating privileges.

A flaw was found in the Linux kernel's vhost-vdpa driver. The vhost_vdpa_config_cb() configuration-change callback loads and signals the v->config_ctx eventfd context without holding a lock or taking a reference, while the VHOST_VDPA_SET_CONFIG_CALL ioctl concurrently swaps that field and drops the last reference to the old context, which is freed immediately with no RCU grace period. A callback that has already loaded the pointer can therefore dereference freed memory, causing kernel slab corruption. With VDUSE as the parent device, this race is reachable from local userspace with access to the device interfaces (the /dev/vduse node is restricted to root by default), for example by injecting a configuration interrupt on the VDUSE fd while another thread swaps the config-call fd on the vhost-vdpa fd. Successful exploitation can crash the kernel (denial of service) and, through memory corruption, potentially escalate privileges. Red Hat rated this flaw Moderate impact with CVSS 3.1 score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting that exploitation requires local access to the vhost-vdpa/VDUSE device interfaces. The vulnerable code is present in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.12 and later through the RHEL CoreOS kernel; fixes for these affected products are currently deferred, and residual risk is limited by the local, privileged device access required to reach the racing code paths. Red Hat Enterprise Linux 6, 7, and the rhel-8.4.0.z stream are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.