CVE-2026-74741
Received Received - Intake

NULL Pointer Dereference in Linux Kernel Net: Ngbe Driver

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode (such as legacy INTx or single MSI), wx->msix_entry is not allocated or initialized. Calling NGBE_INTR_MISC(wx) dereferences wx->msix_entry->entry, leading to a NULL pointer dereference crash. This issue was introduced by fixing the IRQ vector when the number of VFs is 7. Fix the issue by explicitly checking `pdev->msix_enabled` to determine the correct vector index. Additionally, as a side fix, set the interrupt mask to BIT(0) for the non-MSI-X fallback. In MSI/INTx mode, the MISC and queue interrupts share vector 0, and the WX_PX_MISC_IVAR register is only valid in the MSI-X case. Thus, BIT(0) is the correct mask for the miscellaneous cause when MSI-X is disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-74741
EUVD
EUVD-2026-66571

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the Linux kernel's ngbe network driver. It occurs when non-MSI-X interrupts are enabled, such as legacy INTx or single MSI modes. The issue arises because wx->msix_entry is not allocated or initialized in these modes, but the code still tries to access wx->msix_entry->entry, causing a crash.

Detection Guidance

This vulnerability may cause a kernel crash due to a NULL pointer dereference in the ngbe driver when non-MSI-X interrupts are used. Check kernel logs for crashes or oops messages related to the ngbe module. Look for entries indicating NULL pointer dereference in interrupt handling.

Impact Analysis

This vulnerability can cause system crashes or instability when the affected network driver is used in non-MSI-X interrupt mode. Users relying on the ngbe driver for network operations may experience sudden failures or kernel panics.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. If immediate update is not possible, disable the ngbe driver or avoid using non-MSI-X interrupt modes. Monitor kernel logs for crashes and apply vendor patches as soon as available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74741. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart