PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46009 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's PCI Endpoint NTB (Non-Transparent Bridge) function driver. The `epf_ntb_epc_destroy()` helper function performs duplicate resource teardown operations that the caller is expected to handle later. When `.allow_link` fails or `.drop_link` is executed, this double teardown triggers a kernel oops due to accessing already-freed resources. The fix removes the redundant helper and eliminates an unnecessary `pci_epc_put()` call, as EPC device reference counting is properly managed through configfs EPC group lifetime.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux systems with PCI Endpoint NTB hardware, particularly those in embedded, data center, or high-performance computing environments utilizing non-transparent bridge functionality for inter-processor communication.

Technical summary

The vulnerability resides in `drivers/pci/endpoint/functions/pci-epf-ntb.c`. The `epf_ntb_epc_destroy()` function incorrectly performs resource cleanup that duplicates caller responsibilities. This causes use-after-free conditions when the NTB link state changes, specifically during failed `.allow_link` operations or `.drop_link` execution. The fix removes the helper entirely and corrects reference counting by removing the extraneous `pci_epc_put()` call, relying instead on configfs-managed EPC group lifetime.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable tree commits
  • Review systems utilizing PCI Endpoint NTB functionality for kernel stability
  • Monitor kernel logs for oops messages related to NTB link operations during `.allow_link` or `.drop_link` events
  • Validate NTB configurations in test environments before production deployment

Evidence notes

Vulnerability confirmed by Linux kernel stable tree commits. The issue manifests as a kernel oops during NTB link management operations. Multiple stable kernel branches received backported fixes.

Official resources

2026-05-27