CVE-2026-46142

Technical summary

CVE-2026-46142 is a local denial-of-service vulnerability in the Linux kernel's libwx driver affecting virtual function (VF) initialization. The WX_CFG_PORT_ST register is a PF-restricted register; however, the driver does not enforce this restriction during VF device setup. When a VF attempts to read this register during initialization, an illegal register access occurs, leading to a system hang. The fix involves using the PCI bus function ID directly from PCI_FUNC(pdev->devfn) rather than attempting a restricted register read to determine device context. This allows the driver to correctly identify whether the device is operating as a VF and skip the privileged register access.

Business impact

Organizations running virtualized infrastructure or containers on systems using the libwx network driver face availability risk. A malicious or compromised guest workload with local access can intentionally trigger this flaw to hang the host kernel, disrupting all workloads sharing that physical machine. In multi-tenant or cloud environments, this becomes a cross-tenant denial-of-service vector. The impact is localized to availability; there is no data exfiltration or privilege escalation potential from this flaw alone.

Affected systems

Linux kernel systems equipped with libwx-based network hardware and running virtual machine or container workloads. The vulnerability manifests during VF initialization, meaning any system attempting to assign a virtual network function to a guest or container is at risk. The scope is limited to systems where libwx is present and VF functionality is enabled. No specific kernel version range is indicated in the source data; verify affected versions against the Linux kernel security advisory.

Exploitability

Exploitability is limited to local, authenticated contexts: a user or process running inside a VF (virtual machine, container, or unprivileged account on a shared host) with the ability to trigger device initialization can cause the hang. There is no remote attack vector. Availability impact is immediate and deterministic—any VF initialization attempt on a vulnerable kernel will reproduce the hang. Privilege escalation is not possible through this flaw; the attacker must already possess local execution capability.

Remediation

Apply the Linux kernel patch that corrects VF register access logic in the libwx driver. The fix ensures that the driver queries the device type using PCI_FUNC(pdev->devfn) instead of attempting to read the restricted WX_CFG_PORT_ST register during VF initialization. Patch availability and affected kernel versions should be verified against the official Linux kernel security advisories and your distribution's kernel release notes. No workaround is available other than disabling VF functionality or avoiding deployment of guest workloads on vulnerable hosts.

Patch guidance

Identify your Linux kernel version and libwx driver version by checking /proc/version and driver module information. Cross-reference against the Linux kernel security advisory for CVE-2026-46142 to determine which stable kernel series and patch levels include the fix. Most major distributions (Red Hat, Debian, Ubuntu, SUSE) will release patched kernel packages; apply these through your standard patch management process. If your system does not use libwx drivers, this vulnerability does not apply. Test kernel updates in a non-production environment first, particularly if VF functionality is in use.

Detection guidance

Monitor kernel logs for illegal register access events or unexpected system hangs coinciding with VF or guest device initialization. On vulnerable systems, check for the presence of libwx drivers using lspci and driver module lists. VF initialization failures or system stalls without obvious cause warrant investigation. Intrusion detection rules should flag repeated VF initialization attempts from unprivileged contexts if they correlate with system hangs. Host-level hypervisor logs may record unexpected guest-initiated resets or device errors tied to network function assignment.

Why prioritize this

While the CVSS score of 5.5 (Medium) reflects local-only exploitability, the deterministic and immediate denial-of-service impact on virtualized environments warrants prioritization for organizations running multi-tenant or containerized workloads on affected hardware. The flaw is straightforward to trigger and requires no special exploit code—routine VF initialization may expose it. Patching should be elevated if the affected system hosts production VMs or containers.

Risk score, explained

CVSS 5.5 (Medium) reflects: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction needed (UI:N), and high availability impact (A:H). The score appropriately captures that only local actors with some privileges can trigger the flaw, but the outcome—system hang—is severe and deterministic. No confidentiality or integrity impact is present, limiting the score.

Frequently asked questions