EUVD-2026-86647

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

CVE-2026-97993

A vulnerability exists in the Linux kernel 's vhost-vdpa driver within the vhost_vdpa_set_config_call() function. The issue arises because the code swaps the return value of eventfd_ctx_fdget() into v->config_ctx before checking for errors, briefly holding an ERR_PTR . If a config interrupt oc...

CVE-2026-97993

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

CVE-2026-97992

The Linux kernel contains a use-after-free vulnerability in the vhost-vdpa component. The issue occurs because vhost_vdpa_config_cb() accesses v->config_ctx without holding a lock or taking a reference, while VHOST_VDPA_SET_CONFIG_CALL replaces the field and immediately frees the old context v...

EUVD-2026-86646

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

CVE-2026-97992

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...