CVE-2026-46156

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()<br /> <br /> The switch case in loongson_gpu_fixup_dma_hang() may not DC2 or DC3, and<br /> readl(crtc_reg) will access with random address, because the "device" is<br /> from "base+PCI_DEVICE_ID", "base" is from "pdev-&gt;devfn+1". This is wrong<br /> when my platform inserts a discrete GPU:<br /> <br /> lspci -tv<br /> -[0000:00]-+-00.0 Loongson Technology LLC Hyper Transport Bridge Controller<br /> ...<br /> +-06.0 Loongson Technology LLC LG100 GPU<br /> +-06.2 Loongson Technology LLC Device 7a37<br /> ...<br /> <br /> Add a default switch case to fix the panic as below:<br /> <br /> Kernel ade access[#1]:<br /> CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.136-loong64-desktop-hwe+ #4<br /> pc 90000000017e5534 ra 90000000017e54c0 tp 90000001002f8000 sp 90000001002fb6c0<br /> a0 80000efe00003100 a1 0000000000003100 a2 0000000000000000 a3 0000000000000002<br /> a4 90000001002fb6b4 a5 900000087cdb58fd a6 90000000027af000 a7 0000000000000001<br /> t0 00000000000085b9 t1 000000000000ffff t2 0000000000000000 t3 0000000000000000<br /> t4 fffffffffffffffd t5 00000000fffb6d9c t6 0000000000083b00 t7 00000000000070c0<br /> t8 900000087cdb4d94 u0 900000087cdb58fd s9 90000001002fb826 s0 90000000031c12c8<br /> s1 7fffffffffffff00 s2 90000000031c12d0 s3 0000000000002710 s4 0000000000000000<br /> s5 0000000000000000 s6 9000000100053000 s7 7fffffffffffff00 s8 90000000030d4000<br /> ra: 90000000017e54c0 loongson_gpu_fixup_dma_hang+0x40/0x210<br /> ERA: 90000000017e5534 loongson_gpu_fixup_dma_hang+0xb4/0x210<br /> CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)<br /> PRMD: 00000004 (PPLV0 +PIE -PWE)<br /> EUEN: 00000000 (-FPE -SXE -ASXE -BTE)<br /> ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)<br /> ESTAT: 00480000 [ADEM] (IS= ECode=8 EsubCode=1)<br /> BADV: 7fffffffffffff00<br /> PRID: 0014d000 (Loongson-64bit, Loongson-3A6000-HV)<br /> Modules linked in:<br /> Process swapper/0 (pid: 1, threadinfo=(____ptrval____), task=(____ptrval____))<br /> Stack : 0000000000000006 90000001002fb778 90000001002fb704 0000000000000007<br /> 0000000016a65700 90000000017e5690 000000000000ffff ffffffffffffffff<br /> 900000000209f7c0 9000000100053000 900000000209f7a8 9000000000eebc08<br /> 0000000000000000 0000000000000000 0000000000000006 90000001002fb778<br /> 90000001000530b8 90000000027af000 0000000000000000 9000000100054000<br /> 9000000100053000 9000000000ebb70c 9000000100004c00 9000000004000001<br /> 90000001002fb7e4 bae765461f31cb12 0000000000000000 0000000000000000<br /> 0000000000000006 90000000027af000 0000000000000030 90000000027af000<br /> 900000087cd6f800 9000000100053000 0000000000000000 9000000000ebc560<br /> 7a2500147cdaf720 bae765461f31cb12 0000000000000001 0000000000000030<br /> ...<br /> Call Trace:<br /> [] loongson_gpu_fixup_dma_hang+0xb4/0x210<br /> [] pci_fixup_device+0x108/0x280<br /> [] pci_setup_device+0x24c/0x690<br /> [] pci_scan_single_device+0xe0/0x140<br /> [] pci_scan_slot+0xc4/0x280<br /> [] pci_scan_child_bus_extend+0x60/0x3f0<br /> [] acpi_pci_root_create+0x2b4/0x420<br /> [] pci_acpi_scan_root+0x2d4/0x440<br /> [] acpi_pci_root_add+0x21c/0x3a0<br /> [] acpi_bus_attach+0x1a4/0x3c0<br /> [] device_for_each_child+0x6c/0xe0<br /> [] acpi_dev_for_each_child+0x44/0x70<br /> [] acpi_bus_attach+0x290/0x3c0<br /> [] device_for_each_child+0x6c/0xe0<br /> [] acpi_dev_for_each_child+0x44/0x70<br /> [] acpi_bus_attach+0x290/0x3c0<br /> [] acpi_bus_scan+0x6c/0x280<br /> [] acpi_scan_init+0x194/0x310<br /> [] acpi_init+0xcc/0x140<br /> [] do_one_initcall+0x4c/0x310<br /> [] kernel_init_freeable+0x258/0x2d4<br /> [] kernel_init+0x28/0x13c<br /> [] ret_from_kernel_thread+0xc/0xa4