CVE-2026-74741: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
In the Linux kernel, the following vulnerability has been resolved:
net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
In non-MSI-X mode (such as legacy INTx or single MSI), wx->msixentry is not allocated or initialized. Calling NGBEINTRMISC(wx) dereferences wx->msixentry->entry, leading to a NULL pointer dereference crash.
This issue was introduced by fixing the IRQ vector when the number of VFs is 7. Fix the issue by explicitly checking pdev->msixenabled to determine the correct vector index.
Additionally, as a side fix, set the interrupt mask to BIT(0) for the non-MSI-X fallback. In MSI/INTx mode, the MISC and queue interrupts share vector 0, and the WXPXMISCIVAR register is only valid in the MSI-X case. Thus, BIT(0) is the correct mask for the miscellaneous cause when MSI-X is disabled.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the crash?
Systems using the Linux kernel ngbe network driver are exposed when the device operates without MSI-X, including legacy INTx or single-MSI interrupt modes. MSI-X mode allocates and initializes the affected msix_entry data.
What condition triggers the failure?
The failure occurs when the driver enables interrupts in non-MSI-X mode and calls NGBE_INTR_MISC(wx). That path dereferences wx->msix_entry even though it is not allocated or initialized in that mode.
What changes in the fix affect non-MSI-X operation?
The fix checks pdev->msix_enabled to select the appropriate vector index. It also uses BIT(0) as the miscellaneous interrupt mask when MSI-X is disabled, because miscellaneous and queue interrupts share vector 0 in MSI/INTx mode.