CVE-2026-46249

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

03/06/2026

Last modified:

22/07/2026

Description

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Fix PF driver crash with kexec kernel booting During a kexec reboot the hardware is not power-cycled, so AF state from the old kernel can persist into the new kernel. When AF and PF drivers are built as modules, the PF driver may probe before AF reinitializes the hardware. The PF driver treats the RVUM block revision as an indication that AF initialization is complete. If this value is left uncleared at shutdown, PF may incorrectly assume AF is ready and access stale hardware state, leading to a crash. Clear the RVUM block revision during AF shutdown to avoid PF mis-detecting AF readiness after kexec.

Impact

Vector 3.x

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS v3.1 Severity and Metrics:

Base Score: 5.50 MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): None
Availability (A): High

Base Score 3.x

5.50

Severity 3.x

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:o:linux:linux_kernel::::::::	4.20 (including)	5.10.252 (excluding)
cpe:2.3:o:linux:linux_kernel::::::::	5.11 (including)	5.15.202 (excluding)
cpe:2.3:o:linux:linux_kernel::::::::	5.16 (including)	6.1.165 (excluding)
cpe:2.3:o:linux:linux_kernel::::::::	6.2 (including)	6.6.128 (excluding)
cpe:2.3:o:linux:linux_kernel::::::::	6.7 (including)	6.12.75 (excluding)
cpe:2.3:o:linux:linux_kernel::::::::	6.13 (including)	6.18.14 (excluding)
cpe:2.3:o:linux:linux_kernel::::::::	6.19 (including)	6.19.4 (excluding)

To consult the complete list of CPE names with products and versions, see this page

CVE-2026-46249

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools