CVE-2026-46188: Linux Octeon EP VF NULL Pointer Dereference Denial of Service

Technical summary

CVE-2026-46188 is a NULL pointer dereference vulnerability in the octeon_ep_vf driver's receive queue processing function (__octep_vf_oq_process_rx()). The napi_build_skb() function can return NULL when memory allocation fails, but the driver fails to validate the return value before dereferencing it in both single-buffer and multi-fragment code paths. When triggered, this leads to a kernel NULL pointer dereference and denial of service. The vulnerability is classified as CWE-476 (NULL Pointer Dereference).

Business impact

This vulnerability primarily affects availability. A local attacker or unprivileged user on a system running the affected kernel with Octeon EP VF network devices can trigger a kernel crash or hang, resulting in service disruption. This is most relevant to organizations operating specialized networking appliances or embedded systems based on Cavium Octeon processors, or larger deployments where such hardware is used in edge or specialty networking roles.

Affected systems

Linux kernel systems with the octeon_ep_vf driver enabled, typically found on Cavium Octeon-based networking and telecommunications equipment. Standard Linux distributions on x86 or ARM servers are not affected unless specifically compiled with Octeon EP VF support. Affected versions are those where the NULL check fix has not been applied; consult kernel release notes and vendor advisories for specific kernel versions and distributions impacted.

Exploitability

Exploitability is moderate with a low bar to entry. The vulnerability requires local access (CWE-476 with local attack vector) and can be triggered by an unprivileged user through normal network device interaction or traffic processing. No authentication or special privileges are required beyond local user access. However, impact is limited to denial of service; there is no data exposure or privilege escalation potential.

Remediation

Apply the Linux kernel patch that adds NULL checks after both napi_build_skb() calls in __octep_vf_oq_process_rx(), ensuring proper descriptor advancement and fragment consumption on allocation failure. This fix prevents the NULL pointer dereference and allows graceful handling of memory pressure conditions.

Patch guidance

Update the Linux kernel to a version that includes the octeon_ep_vf NULL check fix. Verify the specific kernel version in your distribution's security advisory, as backport timing varies. For mainline kernel users, the fix is available in post-resolution kernel releases. Test patches in a staging environment before production deployment to ensure network performance is unaffected on systems with Octeon EP VF hardware.

Detection guidance

Monitor system logs for kernel panic or oops messages referencing __octep_vf_oq_process_rx() or the octeon_ep_vf driver. Kernel crash dumps will show a NULL pointer dereference in the receive path. On systems with this hardware, enable kernel debugging and watchdog alerts for unexpected reboots or network device driver failures. Intrusion detection systems cannot meaningfully detect this as it stems from internal driver logic rather than external network patterns.

Why prioritize this

Though rated MEDIUM severity, prioritize this for Octeon EP VF systems because the fix is straightforward, the trigger is easy for local users, and unplanned kernel crashes directly impact service continuity. Organizations running Octeon-based network appliances should treat this as higher relative priority within their infrastructure. Standard Linux servers without Octeon hardware can address this in routine patching cycles.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects the local attack vector and high availability impact balanced against the requirement for local access and lack of confidentiality or integrity consequences. The score appropriately captures a denial-of-service scenario triggered by resource exhaustion or normal driver operation during memory pressure, without privilege escalation or data breach risk.

Frequently asked questions