LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46016: remoteproc: xlnx: Only access buffer information if IPI is buffered

In the Linux kernel, the following vulnerability has been resolved: remoteproc: xlnx: Only access buffer information if IPI is buffered In the receive callback check if message is NULL to prevent possibility of crash by NULL pointer dereferencing.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-46016 is a Linux kernel crash flaw in Xilinx remoteproc handling. The public record says a receive callback could dereference a NULL message pointer. Business impact is likely availability-focused, but severity, CVSS, and exploitability details are not published in the provided sources.

Executive priority

Set priority after confirming exposure. If Xilinx-based Linux systems are in production, treat this as a timely availability risk and schedule vendor-supported kernel updates. If the driver path is absent, business urgency is lower.

Technical view

The fix changes the Linux xlnx remoteproc receive callback to access buffer information only when the IPI is buffered and to check for a NULL message. This addresses a NULL pointer dereference path. The record lists Linux kernel versions as affected, but does not provide attack prerequisites or reachable deployment conditions.

Likely exposure

Exposure appears limited to Linux systems using the affected Xilinx remoteproc driver path. Organizations should prioritize embedded, SoC, or vendor kernel deployments where Xilinx remoteproc and IPI handling are enabled. The provided sources do not prove broad server or desktop exposure.

Exploitation context

The source bundle does not cite active exploitation, public exploit code, or KEV listing. It describes a crash condition from NULL pointer dereference, not privilege escalation or data compromise. Treat exploitation status as unconfirmed unless later vendor or threat-intelligence sources say otherwise.

Researcher notes

Evidence supports a NULL pointer dereference fix in Linux remoteproc xlnx code. The public record lacks CVSS, CWE, exploit prerequisites, trigger conditions, and operational impact detail. Do not infer remote exploitability or affected hardware beyond Xilinx remoteproc-related deployments.

Mitigation direction

  • Apply the relevant Linux stable kernel fix or vendor kernel update when available.
  • Check downstream vendor advisories for Xilinx platform-specific guidance.
  • Prioritize systems using Xilinx remoteproc or affected IPI handling.
  • Track kernel package updates for affected long-term support branches.
  • Avoid ad hoc code changes outside vendor-supported kernel maintenance paths.

Validation and detection

  • Inventory Linux kernel versions on Xilinx-based systems.
  • Confirm whether the xlnx remoteproc driver is present and enabled.
  • Verify the applicable stable fix commit is included in deployed kernels.
  • Review vendor kernel changelogs for CVE-2026-46016 coverage.
  • Run regression testing for remoteproc and inter-processor communication workflows.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46016 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5dfb28c257b7c515624ba6b163410ceada451bf2, 5dfb28c257b7c515624ba6b163410ceada451bf2, 5dfb28c257b7c515624ba6b163410ceada451bf2, 5dfb28c257b7c515624ba6b163410ceada451bf2, 5dfb28c257b7c515624ba6b163410ceada451bf2unaffected
LinuxLinux6.4, 0, 6.6.140, 6.12.86, 6.18.27, 7.0.4, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.