CVE-2026-46249
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Fix PF driver crash with kexec kernel booting During a kexec reboot the hardware is not power-cycled, so AF state from the old kernel can persist into the new kernel. When AF and PF drivers are built as modules, the PF driver may probe before AF reinitializes the hardware. The PF driver treats the RVUM block revision as an indication that AF initialization is complete. If this value is left uncleared at shutdown, PF may incorrectly assume AF is ready and access stale hardware state, leading to a crash. Clear the RVUM block revision during AF shutdown to avoid PF mis-detecting AF readiness after kexec.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-06-03 18:16:25.237000
Last modified
2026-11-06 17:17:53.523000
View original CVE JSON
{
"id": "CVE-2026-46249",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-06-03T18:16:25.237",
"lastModified": "2026-11-06T17:17:53.523",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Fix PF driver crash with kexec kernel booting\n\nDuring a kexec reboot the hardware is not power-cycled, so AF state from\nthe old kernel can persist into the new kernel. When AF and PF drivers\nare built as modules, the PF driver may probe before AF reinitializes\nthe hardware.\n\nThe PF driver treats the RVUM block revision as an indication that AF\ninitialization is complete. If this value is left uncleared at shutdown,\nPF may incorrectly assume AF is ready and access stale hardware state,\nleading to a crash.\n\nClear the RVUM block revision during AF shutdown to avoid PF\nmis-detecting AF readiness after kexec."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nocteontx2-af: Solución a la caída del controlador PF con el arranque del kernel kexec\n\nDurante un reinicio kexec, el hardware no se apaga y enciende, por lo que el estado de AF del kernel antiguo puede persistir en el nuevo kernel. Cuando los controladores AF y PF se compilan como módulos, el controlador PF puede sondear antes de que AF reinicialice el hardware.\n\nEl controlador PF trata la revisión del bloque RVUM como una indicación de que la inicialización de AF está completa. Si este valor se deja sin borrar al apagar, PF puede asumir incorrectamente que AF está listo y acceder a un estado de hardware obsoleto, lo que lleva a una caída.\n\nBorrar la revisión del bloque RVUM durante el apagado de AF para evitar que PF detecte incorrectamente la disponibilidad de AF después de kexec."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/af/rvu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"lessThan": "b7605b9301abc18fbbf2b0e23fdd281fc768955d",
"versionType": "git",
"status": "affected"
},
{
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"lessThan": "9769a09afda20a006b528b9e723effcae45965b2",
"versionType": "git",
"status": "affected"
},
{
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"lessThan": "57821d1436ba1c6a6973aa32d54166fdec35558c",
"versionType": "git",
"status": "affected"
},
{
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"lessThan": "8b5ed7c5417b7013d35b6f2507dab739013ba1a9",
"versionType": "git",
"status": "affected"
},
{
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"lessThan": "7d56ba306e93d04696718963fb4cda2883ee7585",
"versionType": "git",
"status": "affected"
},
{
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"lessThan": "9c3398e5b3a914b74276d44ab54c49123b89c61a",
"versionType": "git",
"status": "affected"
},
{
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"lessThan": "1370736836a18b5e0cd74bcc9cffe11d21f1fe79",
"versionType": "git",
"status": "affected"
},
{
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"lessThan": "2d2d574309e3ae84ee794869a5da8b4c38753a94",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/af/rvu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.20",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.20",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.252",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.202",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.165",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.128",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.75",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.14",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.19.4",
"lessThanOrEqual": "6.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-06T16:12:55.966517Z",
"id": "CVE-2026-46249",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.20",
"versionEndExcluding": "5.10.252",
"matchCriteriaId": "AC83D218-5B5C-4467-AFA7-2B557B765D38"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.202",
"matchCriteriaId": "4002FC2B-1456-4666-B240-0EBF590C4671"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.165",
"matchCriteriaId": "797C7F46-D0BE-4FB8-A502-C5EF8E6B6654"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.128",
"matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.75",
"matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.14",
"matchCriteriaId": "BF463CB7-1F58-4607-B847-77ED23E4B9B7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "6.19.4",
"matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/1370736836a18b5e0cd74bcc9cffe11d21f1fe79",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2d2d574309e3ae84ee794869a5da8b4c38753a94",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/57821d1436ba1c6a6973aa32d54166fdec35558c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/7d56ba306e93d04696718963fb4cda2883ee7585",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/8b5ed7c5417b7013d35b6f2507dab739013ba1a9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/9769a09afda20a006b528b9e723effcae45965b2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/9c3398e5b3a914b74276d44ab54c49123b89c61a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b7605b9301abc18fbbf2b0e23fdd281fc768955d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}