CVE-2026-97993

A flaw was found in the Linux kernel's vhost-vdpa subsystem. A local attacker can cause a Denial of Service (DoS) by exploiting a race condition when updating interrupt configurations with an invalid file descriptor. Because the kernel temporarily installs an unvalidated error pointer into the device context, a concurrent interrupt can trigger an invalid pointer dereference and crash the system.

A low-impact race condition was found in the Linux kernel's vhost-vdpa subsystem. When userspace updates the config-call file descriptor of a vhost-vdpa device, vhost_vdpa_set_config_call() briefly swaps the unvalidated eventfd_ctx_fdget() return value into v->config_ctx before checking it, so on failure the field momentarily holds an error pointer. If a device configuration interrupt is delivered inside this window, vhost_vdpa_config_cb() passes the invalid pointer to eventfd_signal(), causing an invalid pointer dereference and a kernel crash. A local attacker with access to a vhost-vdpa device who can issue the configuration ioctl with an invalid file descriptor, combined with precise timing of a concurrent config interrupt, could use this race to cause a denial of service. Only availability is affected; there is no impact to confidentiality or integrity. The affected components are the kernel packages in Red Hat Enterprise Linux 8, 9 and 10 (including kernel-rt), Red Hat In-Vehicle OS 2, and the RHEL CoreOS kernels shipped with OpenShift Container Platform 4 and 5. Red Hat Enterprise Linux 6, 7 and the rhel-8.4.0.z stream are not affected because the vulnerable code is not present there. Fixes for the affected streams are currently deferred to a future scheduled kernel update; the residual risk is limited because exploitation requires privileged local access to a vhost-vdpa device and precise timing to hit the narrow race window. Although the Red Hat CVSS 3.1 base score is 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, moderate), Red Hat rates the impact of this flaw as low given the local, privileged attack path and the denial-of-service-only consequence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.