CVE-2026-74741: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
In the Linux kernel, the following vulnerability has been resolved:
net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
In non-MSI-X mode (such as legacy INTx or single MSI), wx->msixentry is not allocated or initialized. Calling NGBEINTRMISC(wx) dereferences wx->msixentry->entry, leading to a NULL pointer dereference crash.
This issue was introduced by fixing the IRQ vector when the number of VFs is 7. Fix the issue by explicitly checking pdev->msixenabled to determine the correct vector index.
Additionally, as a side fix, set the interrupt mask to BIT(0) for the non-MSI-X fallback. In MSI/INTx mode, the MISC and queue interrupts share vector 0, and the WXPXMISCIVAR register is only valid in the MSI-X case. Thus, BIT(0) is the correct mask for the miscellaneous cause when MSI-X is disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Set the interrupt mask to BIT(0) for the non-MSI-X fallback, and explicitly check pdev->msix_enabled to select the correct vector index; in MSI/INTx mode, use vector 0 because MISC and queue interrupts share it.
Linux kernel net: ngbe interrupt mask for non-MSI-X mode = BIT(0)
Event History
Frequently Asked Questions
Which systems are exposed to the crash?
Systems using the Linux kernel ngbe network driver are exposed when the device operates without MSI-X, including legacy INTx or single-MSI interrupt modes. MSI-X mode allocates and initializes the affected msix_entry data.
What condition triggers the failure?
The failure occurs when the driver enables interrupts in non-MSI-X mode and calls NGBE_INTR_MISC(wx). That path dereferences wx->msix_entry even though it is not allocated or initialized in that mode.
What changes in the fix affect non-MSI-X operation?
The fix checks pdev->msix_enabled to select the appropriate vector index. It also uses BIT(0) as the miscellaneous interrupt mask when MSI-X is disabled, because miscellaneous and queue interrupts share vector 0 in MSI/INTx mode.