CVE-2026-46188: octeon_ep_vf: add NULL check for napi_build_skb()
In the Linux kernel, the following vulnerability has been resolved:
octeonepvf: add NULL check for napibuildskb()
napibuildskb() can return NULL on allocation failure. In octepvfoqprocessrx(), the result is used directly without a NULL check in both the single-buffer and multi-fragment paths, leading to a NULL pointer dereference.
Add NULL checks after both napibuildskb() calls, properly advancing descriptors and consuming remaining fragments on failure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Apply the code-level remedy: in the octeon_ep_vf driver, add NULL checks after both napi_build_skb() calls in __octep_vf_oq_process_rx(); on allocation failure properly advance descriptors and consume remaining fragments, then rebuild and deploy the patched kernel.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46188?
CVE-2026-46188 has a risk rating of 23.
How do I fix CVE-2026-46188?
To resolve CVE-2026-46188, ensure that the patches provided in the Linux kernel updates are applied, specifically those addressing the NULL check in napi_build_skb().
What systems are affected by CVE-2026-46188?
CVE-2026-46188 affects the Linux kernel, particularly the octeon_ep_vf component.
What type of vulnerability is CVE-2026-46188?
CVE-2026-46188 is classified as a Null Pointer Dereference vulnerability.
When was CVE-2026-46188 published?
CVE-2026-46188 was published on May 28, 2026.