PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46236 Linux CVE debrief

A DMA coherency vulnerability in the Linux kernel's Xbox remote driver (xbox_remote) has been resolved. The issue involved a buffer for I/O operations being incorrectly placed within the device structure, violating DMA coherency rules. This could lead to memory corruption or undefined behavior during remote control operations. The fix ensures proper memory allocation for DMA operations by separating the I/O buffer from the device structure.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Linux system administrators running kernels with the xbox_remote driver loaded; embedded systems using Xbox remote control hardware; security teams monitoring kernel driver vulnerabilities affecting DMA operations

Technical summary

The xbox_remote driver in the Linux kernel media subsystem violated DMA coherency rules by placing an I/O buffer within the device structure. This architectural error could cause memory corruption during DMA operations. The resolution separates the I/O buffer from the device structure to maintain proper DMA coherency. Multiple stable kernel branches received backports of this fix.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version and apply appropriate stable kernel patch from referenced commits
  • Verify xbox_remote driver is not loaded on systems without Xbox remote hardware
  • Monitor kernel logs for DMA-related warnings on affected systems
  • Consider disabling the xbox_remote module if not required (blacklist xbox_remote)
  • Apply kernel updates through distribution security channels when available

Evidence notes

The vulnerability description indicates this was a DMA coherency violation in the media/rc/xbox_remote driver. Multiple stable kernel commits are referenced, suggesting backports to various kernel versions. The issue was resolved by ensuring the I/O buffer is not part of the device structure, adhering to DMA coherency requirements.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46236 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46236

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46236 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46236

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0bd8ac88ec5f74cd0f4b8cfc54f4cc0827007249

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0cc9251833bf02c8c7863404157c94dab5928fcf

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/48a668c22e8f92637bc496e84d1cf06900f74a5c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/63a960b39de9c51f29ca19aa5067934f865c0bc7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.