Description

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode (such as legacy INTx or single MSI), wx->msix_entry is not allocated or initialized. Calling NGBE_INTR_MISC(wx) dereferences wx->msix_entry->entry, leading to a NULL pointer dereference crash. This issue was introduced by fixing the IRQ vector when the number of VFs is 7. Fix the issue by explicitly checking `pdev->msix_enabled` to determine the correct vector index. Additionally, as a side fix, set the interrupt mask to BIT(0) for the non-MSI-X fallback. In MSI/INTx mode, the MISC and queue interrupts share vector 0, and the WX_PX_MISC_IVAR register is only valid in the MSI-X case. Thus, BIT(0) is the correct mask for the miscellaneous cause when MSI-X is disabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T15:16:52.867Z",
  "pubdate": "2026-08-26T15:16:52.867Z",
  "executiveSummary": "A NULL pointer dereference vulnerability exists in the Linux kernel's ngbe network driver, specifically within the non-MSI-X interrupt enabling path.\nThe vulnerability occurs when the driver attempts to access the wx->msix_entry structure without confirming that MSI-X mode is enabled.\nThis flaw can be triggered when the system is operating in legacy INTx or single MSI modes, as the msix_entry structure is not allocated in these configurations.\nThe primary impact of this vulnerability is a kernel-level denial-of-service (DoS), manifesting as a system crash (kernel panic) upon the execution of the erroneous interrupt handling code.\nThe vulnerability represents a local stability risk, as the crash occurs within the kernel context. While it does not inherently provide remote code execution, it disrupts system availability.\nExploitation requires the device to be configured in non-MSI-X mode, which may occur depending on hardware capabilities, driver initialization sequences, or specific kernel boot parameters.\nThe issue was introduced by changes related to IRQ vector fixing for Virtual Functions (VFs) and requires an explicit validation of pdev->msix_enabled before dereferencing interrupt-related structures.",
  "technicalDetails": "The vulnerability resides within the ngbe driver's interrupt initialization and handling logic, specifically affecting how the driver interacts with MSI-X structures. In Linux kernel implementations for the ngbe driver, the wx->msix_entry pointer is intended to hold MSI-X vector information. However, this structure is only initialized when the driver successfully negotiates and enables the MSI-X interrupt delivery mechanism.\nWhen the driver operates in legacy INTx or standard MSI modes, the msix_entry array is neither allocated nor populated. The root cause of the crash is a violation of these architectural assumptions within the function NGBE_INTR_MISC(wx). The code explicitly attempts to dereference wx->msix_entry->entry to retrieve an IRQ vector index. Because wx->msix_entry is NULL in non-MSI-X configurations, this dereference operation triggers an immediate NULL pointer dereference exception, resulting in a kernel panic.\nThe attack flow involves the kernel executing the NGBE_INTR_MISC macro or related interrupt setup functions while the device is initialized without MSI-X. This can be triggered by system configurations where the hardware or hypervisor environment forces a fallback to legacy interrupts or if MSI-X is disabled via boot parameters (e.g., pci=nomsi).\nFurthermore, the logic error is compounded by an incorrect configuration of the WX_PX_MISC_IVAR register. In MSI/INTx modes, miscellaneous and queue interrupts are consolidated onto vector 0. The attempt to apply MSI-X specific logic in this shared-vector environment is invalid. The correction involves checking pdev->msix_enabled before accessing the structure and correctly setting the interrupt mask to BIT(0) for non-MSI-X scenarios, ensuring the miscellaneous interrupt cause is appropriately captured without attempting to index into an uninitialized MSI-X entry table.\nThe post-exploitation impact is a definitive system crash, rendering the network interface unusable and potentially impacting overall system uptime. Because this occurs in kernel space, the operation does not require complex user-space exploitation techniques, but it is highly disruptive, effectively serving as an unauthenticated local DoS vector whenever the driver initialization path is forced into the vulnerable state."
}