CVE-2026-46297: Linux Kernel Interrupt Handler Vulnerability

CVE-2026-46297 Overview

CVE-2026-46297 is a Linux kernel vulnerability in the libwx network driver affecting Virtual Function (VF) misc interrupt handling. The driver incorrectly calls request_threaded_irq() with a primary handler, a NULL threaded handler, and the IRQF_ONESHOT flag simultaneously. This combination triggers a kernel WARNING introduced by commit aef30c8d569c in genirq that flags improper use of IRQF_ONESHOT without a threaded handler. The fix replaces the call with request_irq(), the appropriate interface for non-threaded interrupt handlers, and removes the unnecessary IRQF_ONESHOT flag.

Critical Impact
The vulnerability produces a kernel warning at kernel/irq/manage.c:1502 during VF interrupt setup, indicating misuse of interrupt registration interfaces in the Wangxun network driver.

Affected Products

Linux kernel versions containing the libwx driver with the affected interrupt registration code
Wangxun network device Virtual Function (VF) drivers
Linux distributions shipping kernels prior to the stable patches referenced below

Discovery Timeline

2026-06-08 - CVE-2026-46297 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46297

Vulnerability Analysis

The defect resides in the libwx Linux kernel driver, which provides shared functionality for Wangxun network devices. The Virtual Function (VF) misc interrupt setup path registers an interrupt using request_threaded_irq() while passing NULL for the threaded handler argument. At the same time, the call sets the IRQF_ONESHOT flag, which is intended for threaded interrupt handlers that require the IRQ line to remain masked until the threaded handler completes.

Because no threaded handler exists, the IRQF_ONESHOT semantics cannot apply meaningfully. Kernel commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler") added explicit detection for this misconfiguration. As a result, __setup_irq() in kernel/irq/manage.c emits a WARNING at line 1502 when the driver registers the VF misc interrupt.

The issue is a correctness bug in interrupt registration rather than a memory safety flaw. It does not expose a direct exploitation primitive, but it indicates incorrect kernel API usage that produces noisy warnings and can mask legitimate kernel warnings during triage.

Root Cause

The driver author selected request_threaded_irq() when request_irq() was the correct interface for a non-threaded handler. The redundant IRQF_ONESHOT flag compounded the mismatch and triggered the new genirq warning check.

Attack Vector

No authenticated remote attack vector is documented. The condition is triggered during normal driver initialization on systems using Wangxun VF network interfaces. The attackVector field is reported as Unknown, and no proof-of-concept code or exploit is available.

No verified code examples are available. Refer to the upstream kernel patches for the exact source-level changes:

Detection Methods for CVE-2026-46297

Indicators of Compromise

Kernel ring buffer messages containing WARNING: kernel/irq/manage.c:1502 at __setup_irq+0x4fa/0x760 on systems running the libwx driver.
Backtraces in dmesg referencing request_threaded_irq originating from libwx or Wangxun VF driver symbols.
Repeated warning entries appearing during boot or VF probe events on hosts with Wangxun NICs.

Detection Strategies

Monitor /var/log/kern.log and journalctl -k for the specific __setup_irq warning signature tied to libwx.
Inventory kernel versions across the fleet and identify hosts running affected libwx driver builds without the upstream fix.
Correlate Wangxun VF NIC presence with kernel warning telemetry to prioritize patching.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM pipeline and alert on the __setup_irq warning string.
Track stable kernel changelogs for backports of the three referenced commits to validate patch coverage.
Include libwx warning signatures in routine host health checks for systems with SR-IOV enabled NICs.

How to Mitigate CVE-2026-46297

Immediate Actions Required

Identify hosts running the libwx driver with Wangxun Virtual Functions in use through lspci and lsmod inventories.
Apply stable kernel updates that include the patches replacing request_threaded_irq() with request_irq() and removing IRQF_ONESHOT.
Validate that kernel warnings tied to __setup_irq no longer appear after applying the update and rebooting.

Patch Information

The upstream Linux kernel resolved the issue by switching the VF misc interrupt registration to request_irq() and dropping the IRQF_ONESHOT flag. Stable backports are available in the following commits: 1bca036fe360, 7a33345153ee, and a841574c6e57. Apply the version provided by your Linux distribution as soon as it is published.

Workarounds

If patching is not immediately feasible, avoid enabling SR-IOV Virtual Functions on Wangxun NICs to bypass the affected code path.
Filter or suppress the specific warning in monitoring tools only as a temporary measure, ensuring tracking remains in place until the patch is deployed.
Confirm with the hardware vendor whether firmware or driver downgrades to a pre-warning kernel are acceptable in constrained environments.

bash

# Verify whether the libwx driver is loaded and which Wangxun devices are present
lsmod | grep -i wx
lspci -nnk | grep -A3 -i wangxun

# Check kernel ring buffer for the warning signature
dmesg | grep -E "__setup_irq|libwx"