Linux Kernel ngbe CVE-2026-74741

Exploitation requires: (1) the target system must be equipped with a Wangxun WX1860-series network adapter using the ngbe kernel driver, AND (2) the NIC must be operating in non-MSI-X interrupt mode (legacy INTx or single MSI) - this is a non-default configuration on most modern x86 systems where MSI-X is typically negotiated automatically. The vulnerability is NOT reachable on systems where the ngbe NIC has MSI-X enabled (the common case). The number of VFs being set to 7 was the original trigger context, but the NULL dereference is reachable whenever non-MSI-X mode is active. Exploitation is further limited by the niche market penetration of Wangxun NICs, primarily used in Chinese-market servers and select OEM platforms.

The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) warrants scrutiny: if network-received packets trigger the interrupt handling code path that invokes NGBE_INTR_MISC, a remote unauthenticated attacker sending crafted traffic could induce the kernel panic, justifying AV:N/PR:N. However, the description frames the crash site as 'interrupt enabling,' which is consistent with driver initialization or interface bring-up rather than per-packet processing, suggesting AV:L and AC:H (non-MSI-X is non-default in modern systems) may be more accurate. This discrepancy should be verified against the actual kernel code path. The CVSS vector is flagged as potentially overstated - the realistic attack scenario likely requires local system access with affected Wangxun hardware in a specific interrupt configuration, reducing real-world risk considerably. No EPSS data is available, no active exploitation is confirmed, and the ngbe driver serves a niche hardware ecosystem, further constraining the practical attack surface. The impact is a full kernel panic (A:H), with no confidentiality or integrity impact. Treat this as a medium-priority patch for any deployment running Wangxun NICs.

An attacker with the ability to generate network traffic destined for a host running an unpatched kernel with a Wangxun ngbe NIC in non-MSI-X mode sends packets that drive the interrupt handling code path invoking NGBE_INTR_MISC; the macro dereferences the uninitialized wx->msix_entry pointer, triggering a kernel NULL pointer dereference oops and crashing the system. No public exploit or proof-of-concept code has been identified at time of analysis.