Skip to main content

Linux Kernel CVE-2026-46156

| EUVDEUVD-2026-32783 MEDIUM
Improper Locking (CWE-667)
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-vmw4-6x55-pgfq
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Affected LoongArch system powers on with discrete Loongson GPU
  2. Delivery
    ACPI-driven PCI bus scan begins during kernel init
  3. Exploit
    pci_scan_slot() invokes pci_fixup_device() for the GPU
  4. Execution
    loongson_gpu_fixup_dma_hang() switch evaluates unrecognized device ID
  5. Persist
    readl() issued to garbage uninitialized MMIO address (0x7fffffffffffff00)
  6. Impact
    Kernel ADEM exception halts system

Vulnerability Assessment

Weakness
CWE
CWE-667
ASVS 5.0
V15 - Secure Coding and Architecture Proper locking
Exploitation Conditions

Triggering requires two simultaneous conditions: (1) The system must be running a LoongArch CPU (specifically Loongson-64bit, confirmed in trace as Loongson-3A6000-HV) on an affected kernel version, and (2) a discrete GPU with a PCI device ID that does not correspond to the DC2 or DC3 Loongson display controller must be present on the PCI bus - the Loongson LG100 GPU at bus 06.0 is the confirmed trigger in the reported crash. The vulnerability fires during kernel boot (PCI ACPI scan, before any user login), so it is not dependent on any user action, authentication, or non-default configuration setting. Exploitation is limited by hardware specificity: only LoongArch platforms with the particular GPU combination are affected, and x86/ARM/RISC-V systems are entirely unaffected. The CVSS PR:L rating suggests post-boot user interaction but the actual trigger is hardware-initiated at PID 1.
Impact

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) places this as a medium-severity local denial-of-service. The PR:L (low privilege) rating warrants context: the crash trace shows the panic occurs during kernel init at PID 1 (swapper/0) as ACPI scans the PCI bus, meaning the crash is triggered automatically by hardware configuration at boot - not by a post-boot authenticated user. An attacker cannot meaningfully 'exploit' this; on a vulnerable hardware configuration, the system simply does not boot. EPSS at 0.02% (5th percentile) and the absence of a CISA KEV entry align with the hardware-specificity of the trigger. No public exploit or POC exists. Real-world risk is limited to LoongArch (MIPS-successor) hardware deployments running the Loongson platform with a discrete GPU whose device ID is unrecognized by the fixup function - a narrow but real operational failure for affected system builders and enterprise customers deploying Loongson-based hardware. CVSS slightly overstates the 'attacker agency' dimension since this is effectively a hardware-triggered panic, not a privilege-escalation path.
Exploit ScenarioDerived

On a LoongArch workstation or server running an affected kernel version and equipped with a discrete Loongson LG100 GPU (or any Loongson GPU with a device ID not matching DC2/DC3), the system will kernel panic unconditionally during every boot attempt. The ACPI PCI bus scan at init triggers the loongson_gpu_fixup_dma_hang() quirk, which reads MMIO at an uninitialized garbage address (e.g., 0x7fffffffffffff00 as observed in the crash trace), producing an ADEM (Address Error for Memory) exception and halting the system before userspace is reached. No attacker action is required - the hardware configuration alone is sufficient to trigger the DoS.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 09, 2026

Kernel panic (ADE - Address Error for Memory access) in the LoongArch-specific PCI fixup function loongson_gpu_fixup_dma_hang() crashes systems that boot with a discrete Loongson GPU whose PCI device ID does not match any handled case in the switch statement. The missing default case causes readl() to be called with a garbage MMIO address derived from uninitialized register state, resulting in a hard kernel panic at boot time (PID 1, swapper/0) and rendering the system unavailable. No public exploit identified at time of analysis, and EPSS is 0.02% (5th percentile), consistent with a hardware-specific local DoS requiring no attacker interaction.

RemediationAI

Upgrade to a fixed Linux kernel version: 6.6.140, 6.12.88, 6.18.30, 7.0.7, or 7.1-rc3 per vendor-released patch availability confirmed by EUVD. The fix adds a default branch to the switch statement in loongson_gpu_fixup_dma_hang() so that unrecognized PCI device IDs result in a safe no-op rather than an uninitialized MMIO read. Fix commits are published at https://git.kernel.org/stable/c/07d190e4ec689d6478f7f5e36099fb9bf457e7c5 and related stable-tree commits. For LoongArch system operators who cannot patch immediately, a specific compensating control is to blacklist the loongson_gpu_fixup_dma_hang PCI fixup by passing 'pci=nofixups' on the kernel command line - note this disables all PCI quirks and may cause other hardware-specific DMA hang workarounds to be skipped, so it should be treated as a temporary measure only. Alternatively, removing or not inserting the discrete GPU (specifically any Loongson GPU whose PCI device ID is not the DC2 or DC3 controller) eliminates the trigger entirely until a patched kernel is deployed.

Affected VersionsENISA

Linux 6.6.131 <6.6.140
Linux 95db0c9f526d583634cddb2e5914718570fbac87 <8dfa2f8780e486d05b9a0ffce70b8f5fbd62053e
Linux patch: 7.1-rc3
Linux patch: 6.6.140
Linux 6.12.80 <6.12.88
Linux 3446dd359ba9a6ce5a1ca389c0d48c434d3cc915
Linux patch: 7.0.7
Linux patch: 6.18.30
Linux patch: 6.12.88
Linux 6.19.11 <6.20
Linux 151ba1721ac50765e16d293256389ef14553b46e <2cb19b06c09983727573bbe7d7430cbad480a714
Linux 70fb63c5d36cc02eaf336b87ac6a82e657f832a4 <9e1aed63a5552958ef2a9bfd699a3f990e52a77f
Linux 95db0c9f526d583634cddb2e5914718570fbac87 <81fef1c278436e6bd68ee4ca05a0acb96e256561
Linux patch: 0
Linux 6.18.21 <6.18.30
Linux f458dceaa6a35f89180ebd14484983d8e79ecd10 <07d190e4ec689d6478f7f5e36099fb9bf457e7c5
Linux a31da4d5d1fc29d92d2410c60e1ca298b02a6528
Linux 7.0
Linux 6.1.168 <6.2

Affected Packages

euvd linux fix: 6.2, 6.6.140, 6.12.88, 6.18.30, 6.20

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected code resides in the LoongArch architecture-specific PCI quirk subsystem of the Linux kernel (cpe:2.3:o:linux:linux_kernel). The function loongson_gpu_fixup_dma_hang() is registered as a PCI fixup that fires during pci_setup_device() when the PCI bus is enumerated via ACPI. It computes a 'base' address from pdev->devfn+1 and derives a 'device' identifier from base+PCI_DEVICE_ID. A switch statement then dispatches on the device value to set crtc_reg for a subsequent readl() MMIO read. However, when a discrete GPU such as the Loongson LG100 (bus 06.0) is present, its device ID matches no case (DC2 or DC3), so crtc_reg is never initialized and readl() is called with whatever value happened to be in the register - in the captured trace, 0x7fffffffffffff00 (the value from s1), producing ESTAT: [ADEM] (address error for memory access). The CWE-667 (Improper Locking) classification assigned by NVD does not accurately reflect the root cause, which is a missing default branch in a switch statement causing use of an uninitialized pointer - closer in nature to CWE-20 (Improper Input Validation) or CWE-476. The 'Information Disclosure' tag in the source intelligence is also inconsistent with the CVSS impact scores (C:N/I:N/A:H), which correctly describe a pure availability impact.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE 4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 09, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
MEDIUM 5.5
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()

The switch case in loongson_gpu_fixup_dma_hang() may not DC2 or DC3, and readl(crtc_reg) will access with random address, because the "device" is from "base+PCI_DEVICE_ID", "base" is from "pdev->devfn+1". This is wrong when my platform inserts a discrete GPU:

lspci -tv -[0000:00]-+-00.0 Loongson Technology LLC Hyper Transport Bridge Controller ... +-06.0 Loongson Technology LLC LG100 GPU +-06.2 Loongson Technology LLC Device 7a37 ...

Add a default switch case to fix the panic as below:

Kernel ade access[#1]: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.136-loong64-desktop-hwe+ #4 pc 90000000017e5534 ra 90000000017e54c0 tp 90000001002f8000 sp 90000001002fb6c0 a0 80000efe00003100 a1 0000000000003100 a2 0000000000000000 a3 0000000000000002 a4 90000001002fb6b4 a5 900000087cdb58fd a6 90000000027af000 a7 0000000000000001 t0 00000000000085b9 t1 000000000000ffff t2 0000000000000000 t3 0000000000000000 t4 fffffffffffffffd t5 00000000fffb6d9c t6 0000000000083b00 t7 00000000000070c0 t8 900000087cdb4d94 u0 900000087cdb58fd s9 90000001002fb826 s0 90000000031c12c8 s1 7fffffffffffff00 s2 90000000031c12d0 s3 0000000000002710 s4 0000000000000000 s5 0000000000000000 s6 9000000100053000 s7 7fffffffffffff00 s8 90000000030d4000 ra: 90000000017e54c0 loongson_gpu_fixup_dma_hang+0x40/0x210 ERA: 90000000017e5534 loongson_gpu_fixup_dma_hang+0xb4/0x210 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD: 00000004 (PPLV0 +PIE -PWE) EUEN: 00000000 (-FPE -SXE -ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 00480000 [ADEM] (IS= ECode=8 EsubCode=1) BADV: 7fffffffffffff00 PRID: 0014d000 (Loongson-64bit, Loongson-3A6000-HV) Modules linked in: Process swapper/0 (pid: 1, threadinfo=(____ptrval____), task=(____ptrval____)) Stack : 0000000000000006 90000001002fb778 90000001002fb704 0000000000000007 0000000016a65700 90000000017e5690 000000000000ffff ffffffffffffffff 900000000209f7c0 9000000100053000 900000000209f7a8 9000000000eebc08 0000000000000000 0000000000000000 0000000000000006 90000001002fb778 90000001000530b8 90000000027af000 0000000000000000 9000000100054000 9000000100053000 9000000000ebb70c 9000000100004c00 9000000004000001 90000001002fb7e4 bae765461f31cb12 0000000000000000 0000000000000000 0000000000000006 90000000027af000 0000000000000030 90000000027af000 900000087cd6f800 9000000100053000 0000000000000000 9000000000ebc560 7a2500147cdaf720 bae765461f31cb12 0000000000000001 0000000000000030 ... Call Trace: [<90000000017e5534>] loongson_gpu_fixup_dma_hang+0xb4/0x210 [<9000000000eebc08>] pci_fixup_device+0x108/0x280 [<9000000000ebb70c>] pci_setup_device+0x24c/0x690 [<9000000000ebc560>] pci_scan_single_device+0xe0/0x140 [<9000000000ebc684>] pci_scan_slot+0xc4/0x280 [<9000000000ebdd00>] pci_scan_child_bus_extend+0x60/0x3f0 [<9000000000f5bc94>] acpi_pci_root_create+0x2b4/0x420 [<90000000017e5e74>] pci_acpi_scan_root+0x2d4/0x440 [<9000000000f5b02c>] acpi_pci_root_add+0x21c/0x3a0 [<9000000000f4ee54>] acpi_bus_attach+0x1a4/0x3c0 [<90000000010e200c>] device_for_each_child+0x6c/0xe0 [<9000000000f4bbf4>] acpi_dev_for_each_child+0x44/0x70 [<9000000000f4ef40>] acpi_bus_attach+0x290/0x3c0 [<90000000010e200c>] device_for_each_child+0x6c/0xe0 [<9000000000f4bbf4>] acpi_dev_for_each_child+0x44/0x70 [<9000000000f4ef40>] acpi_bus_attach+0x290/0x3c0 [<9000000000f5211c>] acpi_bus_scan+0x6c/0x280 [<900000000189c028>] acpi_scan_init+0x194/0x310 [<900000000189bc6c>] acpi_init+0xcc/0x140 [<9000000000220cdc>] do_one_initcall+0x4c/0x310 [<90000000018618fc>] kernel_init_freeable+0x258/0x2d4 [<900000000184326c>] kernel_init+0x28/0x13c [<9000000000222008>] ret_from_kernel_thread+0xc/0xa4

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-667 – Improper Locking

View all
CVE-2019-10072 HIGH
7.5
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46156 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/366621 REF https://git.kernel.org/stable/c/07d190e4ec689d6478f7f5e36099fb9bf457e7c5 REF https://git.kernel.org/stable/c/2cb19b06c09983727573bbe7d7430cbad480a714 REF https://git.kernel.org/stable/c/81fef1c278436e6bd68ee4ca05a0acb96e256561 REF https://git.kernel.org/stable/c/8dfa2f8780e486d05b9a0ffce70b8f5fbd62053e REF https://git.kernel.org/stable/c/9e1aed63a5552958ef2a9bfd699a3f990e52a77f REF https://git.kernel.org/stable/c/bfde8accc3e3260c0ecbb8cc34361739e1e16f31

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy