CVE-2026-46156 Overview
CVE-2026-46156 is a Linux kernel vulnerability in the LoongArch architecture's loongson_gpu_fixup_dma_hang() function. The function contains a switch statement that fails to handle cases other than DC2 or DC3 device identifiers. When a discrete GPU is inserted into the system, the function computes a device reference from pdev->devfn+1 and performs a readl(crtc_reg) operation against an unmapped address. This triggers a kernel Address Error Exception (ADE) and panics the boot process.
Critical Impact
Systems with discrete GPUs on LoongArch platforms panic during PCI scan, preventing boot and causing local denial of service.
Affected Products
- Linux kernel on the LoongArch (loong64) architecture
- Systems using the loongson_gpu_fixup_dma_hang() PCI device fixup path
- Loongson platforms (observed on Loongson-3A6000-HV) with discrete GPUs such as the LG100
Discovery Timeline
- 2026-05-28 - CVE-2026-46156 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46156
Vulnerability Analysis
The defect resides in the LoongArch PCI quirk loongson_gpu_fixup_dma_hang(). The function iterates over neighboring PCI functions by computing base + PCI_DEVICE_ID, where base is derived from pdev->devfn+1. The switch statement matching the discovered device handles only DC2 and DC3 controllers, with no default branch.
When the platform exposes a discrete GPU such as the Loongson LG100 alongside companion functions, the computed crtc_reg pointer does not map to a valid MMIO region. The subsequent readl(crtc_reg) dereferences an invalid kernel virtual address (BADV: 7fffffffffffff00 in the reported trace). This produces an ADE with ECode=8 EsubCode=1, killing swapper/0 (PID 1) during early acpi_pci_root_create execution.
Root Cause
The root cause is missing input validation in a PCI fixup routine. The switch statement enumerating device identifiers lacks a default arm, so unexpected sibling devices fall through to MMIO access with an unmapped register pointer. The fix adds a default case that returns early, preventing the unsafe readl() call.
Attack Vector
Exploitation is limited to local conditions on LoongArch hardware. An operator inserting a discrete PCIe GPU into a Loongson platform triggers the panic during PCI enumeration on boot. There is no indication of remote exploitation, code execution, or privilege escalation. The realized impact is a denial-of-service boot failure on affected hardware configurations.
The vulnerability is described in prose because no public proof-of-concept exists. The kernel panic trace published with the patch series provides the technical detail required to reproduce the condition on LoongArch hardware with a discrete GPU installed.
Detection Methods for CVE-2026-46156
Indicators of Compromise
- Kernel boot logs containing Kernel ade access followed by loongson_gpu_fixup_dma_hang+0x in the call trace.
- ESTAT register reporting [ADEM] (IS= ECode=8 EsubCode=1) during PCI device scan on LoongArch systems.
- Boot failures on Loongson-3A6000 or similar loong64 hardware after installing a discrete GPU.
Detection Strategies
- Inventory LoongArch systems and identify hosts running unpatched kernels with discrete GPUs attached.
- Monitor serial console and dmesg output for PCI fixup panics during early initialization.
- Correlate hardware change tickets with boot failures to confirm the trigger is GPU insertion rather than another regression.
Monitoring Recommendations
- Forward kernel logs from LoongArch fleet endpoints to a centralized logging platform and alert on ade access strings.
- Track kernel package versions across the LoongArch fleet to confirm patch deployment status.
- Validate PCI topology snapshots against expected device lists to catch unexpected discrete GPU configurations.
How to Mitigate CVE-2026-46156
Immediate Actions Required
- Apply the upstream LoongArch kernel patches that add a default switch case to loongson_gpu_fixup_dma_hang().
- Rebuild and deploy kernels for LoongArch hosts that ship discrete GPUs or are field-upgradeable with one.
- If patching is not yet possible, defer adding discrete GPUs to affected Loongson systems.
Patch Information
The fix is available in the upstream Linux stable tree across multiple branches. Reference commits include Kernel Patch 07d190e4e, Kernel Patch 2cb19b06c, Kernel Patch 81fef1c27, Kernel Patch 8dfa2f878, and Kernel Patch 9e1aed63a. Rebase distribution kernels onto a stable branch containing one of these commits.
Workarounds
- Remove discrete GPUs from Loongson platforms until a patched kernel is installed.
- Boot with an earlier known-good kernel build that predates the introduction of the buggy fixup path, where feasible.
- Restrict physical access and change-management approvals so GPU hardware is not added to unpatched LoongArch systems.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
