Executive brief
The Linux kernel's ngbe network driver can crash when interrupt handling is enabled in non-MSI-X modes (legacy interrupt or single MSI). This occurs because the driver incorrectly dereferences an uninitialized pointer when configuring interrupts, leading to a kernel crash that disrupts networking on affected systems.
Technical details
The vulnerability is a NULL pointer dereference in the ngbe_irq_enable() function. In non-MSI-X interrupt modes (INTx or single MSI), the wx->msix_entry structure is not allocated, but the code unconditionally calls NGBE_INTR_MISC(wx), which dereferences wx->msix_entry->entry. The fix checks pdev->msix_enabled before attempting this dereference and falls back to using BIT(0) for non-MSI-X modes. The bug was introduced by a prior change to support virtual functions, and affects all systems using ngbe network adapters without MSI-X support enabled. A kernel patch is available and has been committed upstream.
Affected products
- Linux Linux kernel Multiple kernel versions containing the ngbe driver
Timeline
- 2026-08-26: disclosed: CVE-2026-74741 published
- 2026-08-11: patched: Upstream fix committed by Paolo Abeni
- 2026-08-23: patched: Fix included in Linux stable tree