CVE-2026-46142: Linux Kernel libwx DOS Vulnerability

CVE-2026-46142 Overview

CVE-2026-46142 is a Linux kernel vulnerability in the libwx network driver used by Wangxun Ethernet controllers. A Virtual Function (VF) attempts to read WX_CFG_PORT_ST, a register restricted to the Physical Function (PF). The illegal register access triggers a system hang during VF initialization. The patched code now derives the bus function ID directly from PCI_FUNC(pdev->devfn) when the device operates as a VF, avoiding the restricted register read.

Critical Impact
VF initialization on affected libwx drivers performs an illegal PF-restricted register read that hangs the host system, producing a denial-of-service condition on virtualized network deployments.

Affected Products

Linux kernel libwx driver (Wangxun network driver shared library)
Systems using Wangxun NICs with SR-IOV Virtual Functions enabled
Kernel branches addressed by commits 33c5bb50, 68a007a7, 694de316, d3bd8040, and f6e656f7

Discovery Timeline

2026-05-28 - CVE-2026-46142 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46142

Vulnerability Analysis

The libwx driver supports Wangxun Ethernet controllers and is shared between Physical Function (PF) and Virtual Function (VF) drivers. During VF initialization, the driver reads WX_CFG_PORT_ST to determine port state information. This register is restricted to PF context and is not accessible from a VF. The hardware rejects the access and the system hangs because the read never completes successfully. The defect falls under the Kernel Vulnerability and Denial of Service categories.

Root Cause

The initialization path did not differentiate between PF and VF execution contexts before issuing the WX_CFG_PORT_ST register read. Code that should only run on the PF was also reached when probing a VF. The fix conditionally branches on device type: when the device is a VF, the bus function ID is obtained directly from PCI_FUNC(pdev->devfn) rather than from the restricted register.

Attack Vector

The condition is triggered by loading the libwx-dependent VF driver against a Wangxun VF, which occurs during normal SR-IOV bring-up. An administrator or automation enabling VFs on an affected host can reach the faulty code path without additional privileges beyond what is already required to manage network devices. Untrusted guest VMs assigned a passthrough VF can also induce the hang at attach time.

No verified exploit code is published. See the Kernel Git Commit 694de316 for the corrective patch.

Detection Methods for CVE-2026-46142

Indicators of Compromise

Host hang or unresponsive kernel observed immediately after enabling SR-IOV VFs on Wangxun NICs
Kernel log entries referencing libwx, WX_CFG_PORT_ST, or stalled VF probe before the hang
Watchdog or hard lockup messages coinciding with VF driver load

Detection Strategies

Inventory hosts running the libwx driver and identify those with SR-IOV enabled on Wangxun controllers
Compare running kernel versions against the fixed commits (33c5bb50, 68a007a7, 694de316, d3bd8040, f6e656f7) to flag unpatched systems
Correlate node availability telemetry with VF attach events to detect hang patterns linked to this defect

Monitoring Recommendations

Collect kernel ring buffer output (dmesg) from hosts with Wangxun NICs and alert on libwx initialization errors
Monitor hypervisor and bare-metal node health for unscheduled reboots following VF assignment
Track package and kernel patch state across the fleet to confirm remediation rollout

How to Mitigate CVE-2026-46142

Immediate Actions Required

Apply the upstream stable kernel update containing the libwx VF register-access fix to all affected hosts
Until patched, avoid enabling SR-IOV Virtual Functions on Wangxun NICs that depend on libwx
Schedule controlled reboots for hosts where VFs have already been provisioned to validate stability after patching

Patch Information

The fix is published across stable kernel branches in commits 33c5bb50, 68a007a7, 694de316, d3bd8040, and f6e656f7. The patch conditions the WX_CFG_PORT_ST read on PF context and uses PCI_FUNC(pdev->devfn) for VF function ID retrieval. Consume the fix through your distribution's kernel update channel.

Workarounds

Disable SR-IOV on affected Wangxun controllers by setting sriov_numvfs to 0 until the kernel is patched
Blacklist the VF driver module on hosts that must remain on an unpatched kernel to prevent the faulty initialization path
Detach assigned VFs from guest VMs before reboot to avoid re-triggering the hang during host bring-up

bash

# Disable VFs on a Wangxun PCI device until the patched kernel is deployed
echo 0 | sudo tee /sys/class/net/<wx_interface>/device/sriov_numvfs

# Verify no VFs are active
lspci | grep -i wangxun