LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46009: PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown epf_ntb_epc_destroy() duplicates the teardown that the caller is supposed to do later. This leads to an oops when .allow_link fails or when .drop_link is performed. Remove the helper. Also drop pci_epc_put(). EPC device refcounting is tied to configfs EPC group lifetime, and pci_epc_put() in the .drop_link path is sufficient.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-46009 is a Linux kernel bug in the PCI endpoint NTB function. A duplicate cleanup path can trigger a kernel oops when link setup fails or a link is dropped. The available sources do not provide CVSS, active exploitation evidence, or a broader impact statement.

Executive priority

Track and remediate through normal kernel patch management, with higher priority for appliances, embedded systems, or lab platforms using PCI endpoint NTB. Current evidence does not justify emergency response without confirmed exposure.

Technical view

The flaw is in pci-epf-ntb resource teardown. epf_ntb_epc_destroy() duplicates cleanup that its caller should perform later, causing an oops in .allow_link failure handling or .drop_link processing. The kernel fix removes the helper and drops an extra pci_epc_put() tied to EPC lifetime handling.

Likely exposure

Exposure appears limited to Linux systems using or enabling PCI endpoint NTB functionality. Standard servers, desktops, or cloud instances are less likely exposed unless this kernel feature is present and exercised. The supplied affected-version data is incomplete and should be checked against vendor kernel advisories.

Exploitation context

The sources do not report active exploitation, public exploit code, or KEV listing. The described failure mode is a kernel oops during specific PCI endpoint link-management paths, suggesting availability risk, but the sources do not establish attacker reachability or privilege requirements.

Researcher notes

The source bundle identifies a duplicate teardown bug and stable kernel fixes, but lacks CVSS, CWE, reachability details, and exploitability analysis. Further assessment should focus on whether local configuration exposes .allow_link or .drop_link paths to untrusted actors.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Prioritize systems using PCI endpoint or NTB functionality.
  • Check Linux distribution advisories for backported fixes.
  • Avoid assuming generic kernel versions are fixed without vendor confirmation.
  • Monitor for additional CVSS or impact updates from Linux CNA sources.

Validation and detection

  • Inventory Linux kernel versions on systems with PCI endpoint roles.
  • Confirm whether pci-epf-ntb is built, loaded, or configured.
  • Map installed kernels to vendor advisories or referenced stable commits.
  • Review kernel logs for oops events around NTB link operations.
  • Retest affected workflows after applying vendor kernel updates.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46009 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8b821cf761503b80d0bd052f932adfe1bc1a0088, 8b821cf761503b80d0bd052f932adfe1bc1a0088, 8b821cf761503b80d0bd052f932adfe1bc1a0088, 8b821cf761503b80d0bd052f932adfe1bc1a0088, 8b821cf761503b80d0bd052f932adfe1bc1a0088, 8b821cf761503b80d0bd052f932adfe1bc1a0088, 8b821cf761503b80d0bd052f932adfe1bc1a0088unaffected
LinuxLinux5.12, 0, 5.15.209, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.