CVE-2026-97993: Linux kernel · vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 26 Oct 2026, 14:05 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.04 LTSlinuxpkg:deb/ubuntu/linux?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gkepkg:deb/ubuntu/linux-gke?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix has been implemented in the Linux kernel to check the file descriptor before installing it in vhost_vdpa_set_config_call(), preventing the error pointer from being stored in the configuration context. Users should update to the fixed kernel versions listed to remediate this issue.
Description
A vulnerability in the Linux kernel's vhost-vdpa component was resolved that involved improper handling of the eventfd_ctx_fdget() return value in the vhost_vdpa_set_config_call() function. The function swapped the return value into a configuration context field before checking for errors, briefly allowing an error pointer (ERR_PTR) to be stored. This could cause a rejected file descriptor to disrupt configuration interrupts, silently stopping them until a new file descriptor was installed by userspace.
References
- ubuntu.com/security/CVE-2026-97993 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-97993 (opens in a new tab)
- git.kernel.org/stable/c/65faf9eaa00e408e1406fbcf675c8c8d0e27ff2a (opens in a new tab)
- git.kernel.org/stable/c/388c678639a0cebfd936b3e56c64ac6a371efec2 (opens in a new tab)
- git.kernel.org/stable/c/e74a9fa50749b9940b4fb13199652325e08d3c4a (opens in a new tab)
- git.kernel.org/stable/c/6b20b40f020bde236f6b8a08ff88d8653261ec2b (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2026-97993 (opens in a new tab)
- git.kernel.org/stable/c/4fde085eb839fbb39c25cbba5d2a091ded394877 (opens in a new tab)
- git.kernel.org/stable/c/59fc7c1c6b4d325194ca45352180340092d95098 (opens in a new tab)
- git.kernel.org/stable/c/66e73fa18910b39fea0941dea5fe091122240855 (opens in a new tab)
- git.kernel.org/stable/c/e260dc9fbfdae0978e7a8698f977fbb463a657be (opens in a new tab)