CVE-2026-46156

Technical summary

The vulnerability exists in the Loongson GPU fixup code (drivers/gpu/drm/loongson or equivalent) where a switch statement processes GPU device types without a default case. The function constructs a device identifier from `base + PCI_DEVICE_ID`, where `base` derives from `pdev->devfn + 1`. When a discrete GPU is inserted in certain PCI configurations (for example, at slot 06.2 rather than the expected 06.0), the device identifier does not match the expected DC2 or DC3 cases, leaving the switch statement to fall through without handling the mismatch. Subsequent code then calls `readl(crtc_reg)` with an uninitialized or invalid `crtc_reg` value, resulting in an Address Error Exception (ADE). The fix adds a default case to safely handle unexpected device identifiers and prevent the uncontrolled memory access.

Business impact

Systems experiencing this crash lose availability during boot or kernel initialization, requiring manual intervention or reboot. For cloud or data center deployments using Loongarch-based infrastructure, this represents an unplanned downtime risk. Automated deployments that rely on clean kernel initialization will fail when encountering this condition. The impact is limited to availability (no data exposure or integrity compromise), but can cascade into service disruptions if the affected hardware is part of a critical infrastructure or boot sequence.

Affected systems

The vulnerability affects Linux kernels running on Loongarch-based systems equipped with discrete Loongson GPUs, particularly when the GPU occupies non-standard PCI device slots. Systems with the standard GPU configuration (e.g., slot 06.0) may not trigger the condition if the switch statement happens to match a default case, but any platform with discrete GPU variants or custom PCI configurations is at risk. Specific affected products are Linux kernel implementations on Loongarch platforms; verify your kernel version and GPU device configuration against the vendor advisory.

Exploitability

Exploitation requires local access to the affected system and the presence of specific hardware (a discrete Loongson GPU in a non-standard PCI configuration). The vulnerability manifests automatically during driver initialization, with no user interaction needed once the hardware condition exists. An attacker cannot remotely trigger this vulnerability, and it does not enable privilege escalation or code execution—the crash occurs in kernel context but is an unintended denial of service rather than a controlled attack vector. The issue is more accurately classified as a compatibility bug that happens to cause a crash under certain hardware configurations.

Remediation

Apply a kernel update that includes the fix to `loongson_gpu_fixup_dma_hang()`. The patch adds a default case to the switch statement, ensuring that unrecognized GPU device identifiers are safely ignored rather than leading to invalid memory access. Verify the specific patch version in your kernel distribution's advisory. Alternatively, if a kernel update is not immediately available, systems can be temporarily protected by avoiding the hardware configuration that triggers the condition (e.g., ensuring GPUs are in the expected PCI slots) or by disabling GPU hardware acceleration if operationally feasible, pending patched kernel availability.

Patch guidance

Consult the Linux kernel security advisory and your distribution maintainer for the specific patched kernel version. The fix is minimal (adding a switch default case) and low-risk. Apply the update at your next scheduled maintenance window or immediately if affected systems are critical. Test the patched kernel in a staging environment first, particularly on Loongarch platforms with discrete GPU hardware, to confirm the crash no longer occurs during boot.

Detection guidance

Monitor kernel logs for Address Error Exception (ADE) events during PCI device initialization, particularly those mentioning `loongson_gpu_fixup_dma_hang()`. A telltale sign is a panic in early boot with BADV (bad address) values pointing to unmapped memory (e.g., 0x7fffffffffffff00 as shown in the advisory). Check hardware inventory to identify systems running Loongarch with discrete Loongson GPUs. Kernel crash dumps and serial logs should clearly show the function name in the call stack.

Why prioritize this

This is a medium-severity local denial-of-service affecting a specialized hardware platform. Prioritize patching if you operate Loongarch-based systems with discrete Loongson GPUs; the crash prevents system boot in affected configurations. For organizations running mainstream x86/ARM Linux deployments, this is a lower priority. However, given the simplicity of the fix and the severity of the impact on affected systems, consider it a targeted, high-urgency patch for Loongarch users.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector with low privileges required, no user interaction, and high availability impact (kernel crash). There is no confidentiality or integrity impact. The score appropriately weights the denial-of-service nature of the vulnerability, balanced against the requirement for local access and specific hardware conditions that limit the overall attack surface.

Frequently asked questions