CVE-2026-46188: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46188 Overview

CVE-2026-46188 is a NULL pointer dereference vulnerability in the Linux kernel's octeon_ep_vf network driver. The flaw resides in the __octep_vf_oq_process_rx() function, which handles receive queue processing for Octeon Ethernet Endpoint Virtual Function devices. The function calls napi_build_skb() and uses its return value directly without checking for NULL. Because napi_build_skb() can return NULL on allocation failure, the driver dereferences a null pointer in both the single-buffer and multi-fragment receive paths. The issue has been resolved in upstream Linux kernel commits.

Critical Impact

Allocation failure during receive processing triggers a kernel NULL pointer dereference, leading to a kernel oops or system crash on hosts using the Marvell Octeon EP VF network driver.

Affected Products

• Linux kernel versions including the octeon_ep_vf driver prior to the fix commits
• Systems using Marvell Octeon Ethernet Endpoint Virtual Function network interfaces
• Distributions shipping the affected kernel branches before backporting the patch

Discovery Timeline

• 2026-05-28 - CVE-2026-46188 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46188

Vulnerability Analysis

The vulnerability sits in the receive path of the octeon_ep_vf driver, specifically in __octep_vf_oq_process_rx(). This function processes inbound packets from the output queue (OQ) and constructs socket buffers (sk_buff) using napi_build_skb(). The driver invokes napi_build_skb() in two distinct code paths: one for single-buffer packets and one for multi-fragment packets. In both paths, the returned pointer is used immediately to populate skb fields and forward the packet up the network stack. When system memory pressure causes napi_build_skb() to return NULL, the subsequent dereference produces a kernel NULL pointer access [CWE-476]. The result is a kernel oops that destabilizes the network stack and can crash the host. Because the failure originates in normal packet reception, no special protocol behavior is required to reach the vulnerable code.

Root Cause

The root cause is a missing return value check on napi_build_skb(). Kernel API conventions require callers to handle allocation failure, but the original driver code assumed success. Neither the single-buffer nor multi-fragment branch validated the pointer before use.

Attack Vector

The condition is reached during ordinary receive queue processing on affected Octeon EP VF interfaces. Triggering the NULL return requires memory allocation failure inside napi_build_skb(), which typically arises under memory exhaustion. An attacker capable of generating sustained receive traffic combined with memory pressure could provoke the crash, producing a denial-of-service condition on the host.

No verified public exploitation code is available. The vulnerability is described in prose per the upstream commit message. See the kernel.org stable commit for the patch source.

Detection Methods for CVE-2026-46188

Indicators of Compromise

• Kernel oops or panic messages referencing __octep_vf_oq_process_rx or napi_build_skb in dmesg output
• Unexpected network interface resets or link flaps on Octeon EP VF interfaces correlated with memory pressure events
• Soft lockups or NAPI poll failures logged by the octeon_ep_vf driver

Detection Strategies

• Monitor kernel ring buffer and journalctl -k output for NULL pointer dereference stack traces involving the octeon_ep_vf module
• Correlate host memory pressure metrics with network driver errors to identify systems at risk
• Inventory hosts loading the octeon_ep_vf kernel module to scope exposure across the fleet

Monitoring Recommendations

• Forward kernel logs to a centralized logging or SIEM platform and alert on BUG: or Oops: entries naming the affected driver
• Track running kernel versions through configuration management to confirm patched builds are deployed
• Watch host availability and NIC error counters on systems using Marvell Octeon Ethernet Endpoint VF adapters

How to Mitigate CVE-2026-46188

Immediate Actions Required

• Identify all systems running kernels that include the unpatched octeon_ep_vf driver and prioritize them for update
• Apply vendor-supplied kernel updates that incorporate the upstream fix commits
• Reduce memory pressure on affected hosts to lower the probability of triggering napi_build_skb() allocation failure until patching completes

Patch Information

The fix adds NULL checks after both napi_build_skb() calls, advances descriptors correctly, and consumes remaining fragments on failure. Patches are available in the following upstream commits: 60246cdd4c51, 6fef6640bbf3, b0f4711b426a, and dd66b4285470. Rebuild and deploy kernels containing these commits, or install distribution updates that backport them.

Workarounds

• Unload the octeon_ep_vf module on hosts that do not require Octeon EP VF networking until a patched kernel is installed
• Allocate additional system memory or tighten cgroup memory limits to minimize allocation failures inside the NAPI receive path
• Provision redundant network paths so that a driver crash on one host does not interrupt service availability