PatchSiren cyber security CVE debrief

CVE-2026-46009 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's PCI Endpoint NTB (Non-Transparent Bridge) function driver. The `epf_ntb_epc_destroy()` helper function performs duplicate resource teardown operations that the caller is expected to handle later. When `.allow_link` fails or `.drop_link` is executed, this double teardown triggers a kernel oops due to accessing already-freed resources. The fix removes the redundant helper and eliminates an unnecessary `pci_epc_put()` call, as EPC device reference counting is properly managed through configfs EPC group lifetime.

Vendor: Linux
Product: Unknown
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-06-16
Advisory published: 2026-05-27
Advisory updated: 2026-06-16

Who should care

Organizations running Linux systems with PCI Endpoint NTB hardware, particularly those in embedded, data center, or high-performance computing environments utilizing non-transparent bridge functionality for inter-processor communication.

Technical summary

The vulnerability resides in `drivers/pci/endpoint/functions/pci-epf-ntb.c`. The `epf_ntb_epc_destroy()` function incorrectly performs resource cleanup that duplicates caller responsibilities. This causes use-after-free conditions when the NTB link state changes, specifically during failed `.allow_link` operations or `.drop_link` execution. The fix removes the helper entirely and corrects reference counting by removing the extraneous `pci_epc_put()` call, relying instead on configfs-managed EPC group lifetime.

Defensive priority

medium

Recommended defensive actions

Apply kernel updates containing the referenced stable tree commits
Review systems utilizing PCI Endpoint NTB functionality for kernel stability
Monitor kernel logs for oops messages related to NTB link operations during `.allow_link` or `.drop_link` events
Validate NTB configurations in test environments before production deployment

Evidence notes

Vulnerability confirmed by Linux kernel stable tree commits. The issue manifests as a kernel oops during NTB link management operations. Multiple stable kernel branches received backported fixes.

Sources and references

Verified primary and authoritative sources

CVE-2026-46009 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46009

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46009 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46009

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/3446beddba450c8d6f9aca2f028712ac527fead3

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/65fc57c8b8f0b31be62be291cb1bb01755cec85d

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/72099f015d3c77bf2eb703d1aab113bd7a60915a

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/756ca5e7ed22d9045bb4de4c981f9149278d5cd3

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/e813c95e4c8edd31599081e6356e20ada30e266d

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.