PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46016 Linux CVE debrief

A NULL pointer dereference vulnerability in the Linux kernel's Xilinx remoteproc driver could allow a local attacker to cause a system crash. The flaw exists in the receive callback where buffer information is accessed without first verifying that the Inter-Processor Interrupt (IPI) message is buffered. The vulnerability has been resolved by adding a NULL check on the message pointer before accessing buffer information.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux systems with Xilinx remoteproc drivers enabled, particularly those using heterogeneous multi-core processing with Xilinx Zynq or Versal devices. System administrators maintaining embedded Linux deployments on Xilinx hardware should prioritize patching.

Technical summary

The vulnerability exists in the Xilinx (xlnx) remoteproc driver within the Linux kernel. The receive callback fails to check if the IPI message is NULL before accessing buffer information, leading to a potential NULL pointer dereference crash. The fix adds a conditional check to only access buffer information when the IPI is actually buffered, preventing the crash.

Defensive priority

medium

Recommended defensive actions

  • Apply the relevant kernel patch from the stable kernel tree to affected systems
  • Update to a patched kernel version that includes the fix for CVE-2026-46016
  • Review systems using Xilinx remoteproc for potential exposure
  • Monitor kernel logs for any remoteproc-related crashes that may indicate exploitation attempts

Evidence notes

The vulnerability description indicates this is a NULL pointer dereference in the Xilinx remoteproc driver, specifically in the receive callback. The fix adds a check for NULL message before accessing buffer information. Multiple stable kernel commits are referenced, suggesting backports to various kernel versions.

Official resources

2026-05-27