CVE-2026-46297: Linux Kernel libwx VF Interrupt Handling Vulnerability

Technical summary

CVE-2026-46297 occurs in the libwx driver's interrupt setup for virtual functions. The driver calls request_threaded_irq() with a valid primary handler, a NULL threaded handler, and the IRQF_ONESHOT flag set. This combination is invalid because IRQF_ONESHOT is designed to hold the interrupt disabled until a threaded handler completes—but there is no threaded handler. The kernel commit aef30c8d569c introduced a warning to catch this misconfiguration. The proper fix uses request_irq() instead, which is designed for non-threaded interrupt handlers and does not require or accept the IRQF_ONESHOT flag.

Business impact

This vulnerability causes kernel warnings and can lead to unpredictable interrupt handling behavior in systems using virtual function drivers based on libwx (such as certain Intel or Wangxun network adapters in virtualized environments). In production environments, improper interrupt handling can cause system hangs, performance degradation, or unexpected crashes, particularly under high network load or during VM migration scenarios. Organizations running virtualized infrastructure with affected adapters face potential service interruptions.

Affected systems

The Linux kernel in any version that includes the libwx driver with the vulnerable interrupt setup pattern. This primarily affects systems using Wangxun or compatible network adapters in virtual machine hosts or cloud environments where virtual function passthrough or SR-IOV is enabled. The vulnerability is present in mainline kernel versions before the fix is applied; specific affected version ranges should be verified against the applicable Linux distribution's advisory.

Exploitability

This is not a remotely exploitable vulnerability. Exploitation requires local access and the ability to trigger interrupt processing on the affected network device—typically through sustained network traffic or explicit driver operations. The vulnerability manifests as a kernel warning and degraded interrupt handling rather than arbitrary code execution. An unprivileged local user with network access to a virtual function could potentially trigger the warning condition repeatedly, leading to denial of service through interrupt mishandling.

Remediation

Apply a kernel update that includes the fix for CVE-2026-46297. The fix modifies the libwx driver to use request_irq() in place of request_threaded_irq() for the VF miscellaneous interrupt handler, and removes the IRQF_ONESHOT flag. Verify that the kernel version or distribution patch level matches or exceeds the version containing this fix before deployment.

Patch guidance

Monitor your Linux distribution's security advisories and kernel update channels for patches addressing CVE-2026-46297. If you are running a custom or mainline kernel, apply the patch that changes the VF interrupt setup in the libwx driver from request_threaded_irq() to request_irq(). Test the patched kernel in a non-production environment first, particularly if your workload involves high-volume network traffic or virtual function operations. Kernel updates typically require a system reboot; plan maintenance windows accordingly.

Detection guidance

Review kernel logs (dmesg, /var/log/kern.log) for warnings originating from kernel/irq/manage.c line 1502 with the message about IRQF_ONESHOT. Affected systems will show warnings when the libwx driver loads or when virtual functions are initialized. Monitor interrupt statistics using /proc/interrupts or tools like 'watch' to identify anomalous interrupt counts on affected adapters. In virtualized environments, correlate VF initialization with warnings in the host kernel log.

Why prioritize this

This vulnerability rates as medium severity (CVSS 5.5) due to its local attack vector, requirement for system access, and impact limited to denial of service through interrupt mishandling rather than data breach or code execution. However, it should be prioritized for systems running high-availability workloads or cloud infrastructure where virtual function drivers are active, because even occasional interrupt mishandling can cascade into service disruptions. Organizations with Wangxun adapters or compatible SR-IOV configurations should treat this as a standard maintenance priority rather than an emergency.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: attack vector LOCAL (system access required), attack complexity LOW (no special conditions), privilege level LOW (unprivileged user can trigger), user interaction NOT required, scope UNCHANGED (impact confined to the affected device), confidentiality NONE (no data disclosure), integrity NONE (no data modification), and availability HIGH (interrupt mishandling causes DoS). The score does not escalate to high because exploitation is local-only and requires presence of the specific hardware driver, but the high availability impact reflects real risk to system stability.

Frequently asked questions