CVE-2026-74741: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74741 Overview

CVE-2026-74741 is a NULL pointer dereference vulnerability in the Linux kernel ngbe network driver. The flaw affects the driver's interrupt enabling path when operating in non-MSI-X mode, such as legacy INTx or single MSI configurations. In these modes, the wx->msix_entry structure is neither allocated nor initialized. The NGBE_INTR_MISC(wx) macro dereferences wx->msix_entry->entry, triggering a kernel crash. The regression was introduced by an earlier fix to the IRQ vector logic for the case where seven virtual functions (VFs) are enabled. Upstream maintainers have merged patches to correct the vector selection and interrupt mask logic.

Critical Impact
Local or network-adjacent triggers of the affected interrupt path can crash the Linux kernel, causing denial of service on systems using Wangxun ngbe network hardware.

Affected Products

Linux kernel with the net/ethernet/wangxun/ngbe driver enabled
Systems using Wangxun Gigabit Ethernet adapters in non-MSI-X interrupt modes
Kernel builds prior to the fixes referenced in commits 0ab482b2195e, 5f3a13e0bb5e, and cef4c5b9aca2

Discovery Timeline

2026-08-26 - CVE-2026-74741 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74741

Vulnerability Analysis

The vulnerability resides in the ngbe driver's interrupt initialization routine. When the driver enables miscellaneous interrupts, it calls the NGBE_INTR_MISC(wx) macro. This macro assumes the wx->msix_entry pointer references a valid array of MSI-X entries. In non-MSI-X modes, this pointer is NULL because the driver never allocates MSI-X vectors. Dereferencing wx->msix_entry->entry triggers a NULL pointer dereference and kernel oops. This class of defect is a Null Pointer Dereference issue leading to denial of service.

Root Cause

The regression was introduced by an earlier patch that adjusted IRQ vector selection to handle the specific case of seven active VFs. That change removed the branch that previously distinguished MSI-X from non-MSI-X paths. As a result, the code unconditionally accessed the msix_entry array even when MSI-X was disabled. Additionally, the driver programmed the WX_PX_MISC_IVAR register under the assumption that MSI-X was always available. In MSI/INTx mode, the miscellaneous and queue causes share vector 0, so the correct interrupt mask is BIT(0).

Attack Vector

The attack vector requires triggering the interrupt enable code path on a host using the ngbe driver in legacy INTx or single MSI mode. Any condition that causes the driver to re-enable miscellaneous interrupts, including link-state transitions or administrative operations, can reach the vulnerable code. Successful triggering crashes the kernel and terminates all workloads on the affected host.

No verified proof-of-concept code is publicly available. The fix explicitly checks pdev->msix_enabled to select the correct vector index and sets the interrupt mask to BIT(0) for the non-MSI-X fallback. See the referenced Kernel Git Commit Log for the applied patch.

Detection Methods for CVE-2026-74741

Indicators of Compromise

Kernel oops or panic messages referencing ngbe_irq_enable, NGBE_INTR_MISC, or msix_entry in system logs
Unexpected reboots or hangs on hosts equipped with Wangxun Gigabit Ethernet controllers
dmesg output containing NULL pointer dereference traces in the wangxun driver stack

Detection Strategies

Inventory Linux hosts using the ngbe kernel module with lsmod | grep ngbe and correlate against kernel build versions
Parse /var/log/kern.log and journalctl -k for stack traces referencing the ngbe or libwx modules
Track kernel package versions across the fleet to identify hosts running builds prior to the referenced upstream commits

Monitoring Recommendations

Alert on unexpected kernel crash events from hosts with Wangxun network adapters
Monitor host availability metrics for network-interface-adjacent instability
Forward kernel ring buffer output to a centralized logging platform for retention and correlation

How to Mitigate CVE-2026-74741

Immediate Actions Required

Identify hosts running the ngbe driver and confirm whether they operate in MSI-X, MSI, or legacy INTx mode
Apply vendor-supplied kernel updates that include the upstream commits 0ab482b2195e, 5f3a13e0bb5e, and cef4c5b9aca2
Prioritize patching hosts where MSI-X is disabled or where the driver falls back to INTx or single MSI

Patch Information

The fix has been merged upstream in the Linux kernel. Three stable commits address the defect and are referenced in the NVD entry: commit 0ab482b2195e, commit 5f3a13e0bb5e, and commit cef4c5b9aca2. Distribution maintainers backport these fixes into supported kernel packages. Apply distribution updates as they become available.

Workarounds

Where hardware supports it, enable MSI-X mode on Wangxun adapters to avoid the vulnerable non-MSI-X code path
Blocklist the ngbe module on hosts that do not require the affected hardware until patched kernels are deployed
Restrict administrative operations that toggle interface state on unpatched hosts to reduce trigger opportunities

bash

# Configuration example
# Check if the ngbe module is loaded
lsmod | grep ngbe

# Inspect current MSI-X status for a Wangxun device
lspci -vvv -s <pci-bdf> | grep -i msi

# Verify kernel version against fixed builds
uname -r