CVE-2026-46009 Overview
CVE-2026-46009 affects the Linux kernel PCI endpoint subsystem, specifically the pci-epf-ntb (Non-Transparent Bridge) driver. The function epf_ntb_epc_destroy() duplicates teardown logic that the caller is expected to perform later in the lifecycle. This duplication triggers a kernel oops when the .allow_link configfs callback fails or when .drop_link runs. The fix removes the redundant helper and drops a pci_epc_put() call, since EPC device refcounting is already managed by configfs EPC group lifetime.
Critical Impact
A kernel oops is triggered in the PCI endpoint NTB driver when .allow_link fails or during .drop_link, leading to denial of service on affected Linux systems configuring PCI endpoint NTB functions.
Affected Products
- Linux kernel versions containing the pci-epf-ntb endpoint function driver
- Systems using PCI endpoint framework with Non-Transparent Bridge configurations
- Embedded and server platforms exposing PCI endpoint configfs interfaces
Discovery Timeline
- 2026-05-27 - CVE-2026-46009 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46009
Vulnerability Analysis
The vulnerability resides in the Linux kernel PCI endpoint function driver for Non-Transparent Bridge devices (drivers/pci/endpoint/functions/pci-epf-ntb.c). The epf_ntb_epc_destroy() helper performs resource teardown that the caller also performs at a later stage in the configfs lifecycle. When the .allow_link configfs operation fails, or when .drop_link is invoked to detach an endpoint controller from an NTB function, the duplicated teardown runs against already-released resources. This double-teardown produces a kernel oops, halting the affected kernel context and disrupting PCI endpoint operations.
Root Cause
The root cause is duplicated resource cleanup logic. The epf_ntb_epc_destroy() function releases resources that the configfs link management callbacks subsequently release again. Additionally, pci_epc_put() was invoked in a path where EPC device refcounting is already tied to the configfs EPC group lifetime. The redundant put unbalances reference counts. The corrective patches remove the helper and drop the extraneous pci_epc_put(), relying on the .drop_link path alone for refcount release.
Attack Vector
The issue requires local access to configure PCI endpoint functions through configfs, typically restricted to privileged users on platforms supporting PCIe endpoint mode. Triggering the oops involves creating an NTB endpoint function, linking it to an EPC controller, and inducing .allow_link failure or invoking .drop_link. The vulnerability is not remotely exploitable and primarily represents a kernel reliability and denial-of-service issue rather than a code execution primitive.
The vulnerability mechanism involves duplicated teardown paths in epf_ntb_epc_destroy() combined with an unbalanced pci_epc_put(). See the upstream kernel commits referenced below for the full patch contents.
Detection Methods for CVE-2026-46009
Indicators of Compromise
- Kernel oops messages referencing epf_ntb_epc_destroy or pci-epf-ntb in dmesg output
- Kernel panic or NULL pointer dereference traces during PCI endpoint configfs .drop_link operations
- Unexpected system reboots on platforms actively configuring PCI endpoint NTB functions
Detection Strategies
- Audit kernel versions across Linux fleets and compare against patched stable branches referenced in the upstream commits
- Monitor kernel logs for oops signatures originating from the pci-epf-ntb driver path
- Inventory systems with PCI endpoint configfs enabled (/sys/kernel/config/pci_ep/) to scope exposure
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized logging platform for anomaly review
- Alert on repeated kernel oops events involving PCI endpoint or NTB symbols
- Track configfs activity under /sys/kernel/config/pci_ep/functions/pci_epf_ntb/ on platforms where this driver is loaded
How to Mitigate CVE-2026-46009
Immediate Actions Required
- Apply the upstream Linux kernel patches that remove the duplicate teardown helper and the extraneous pci_epc_put() call
- Restrict access to PCI endpoint configfs interfaces to root and trusted automation only
- Unload the pci-epf-ntb module on systems that do not require NTB endpoint functionality
Patch Information
The vulnerability is resolved in upstream Linux kernel commits. Refer to the patch sets at Linux Kernel Commit 3446bedd, Linux Kernel Commit 65fc57c8, Linux Kernel Commit 72099f01, Linux Kernel Commit 756ca5e7, and Linux Kernel Commit e813c95e. Apply the patch corresponding to your stable kernel branch and rebuild or update to a distribution kernel containing the fix.
Workarounds
- Avoid invoking .drop_link on NTB endpoint function configurations until patched kernels are deployed
- Prevent loading of the pci-epf-ntb module via modprobe blacklist where the driver is not required
- Limit configfs write permissions on PCI endpoint directories to reduce exposure to triggering conditions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
