CVE-2026-46249

Description

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Fix PF driver crash with kexec kernel booting During a kexec reboot the hardware is not power-cycled, so AF state from the old kernel can persist into the new kernel. When AF and PF drivers are built as modules, the PF driver may probe before AF reinitializes the hardware. The PF driver treats the RVUM block revision as an indication that AF initialization is complete. If this value is left uncleared at shutdown, PF may incorrectly assume AF is ready and access stale hardware state, leading to a crash. Clear the RVUM block revision during AF shutdown to avoid PF mis-detecting AF readiness after kexec.

Is your site exposed to CVE-2026-46249?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploit Prediction

0.0012

Probability of exploitation

0.02%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Affected Products

Vendor	Product	Versions
linux	linux_kernel	4.20 — 5.10.252
linux	linux_kernel	5.11 — 5.15.202
linux	linux_kernel	5.16 — 6.1.165
linux	linux_kernel	6.2 — 6.6.128
linux	linux_kernel	6.7 — 6.12.75
linux	linux_kernel	6.13 — 6.18.14
linux	linux_kernel	6.19 — 6.19.4

References

Advisories & Patches

https://git.kernel.org/stable/c/1370736836a18b5e0cd74bcc9cffe11d21f1fe79 https://git.kernel.org/stable/c/2d2d574309e3ae84ee794869a5da8b4c38753a94 https://git.kernel.org/stable/c/57821d1436ba1c6a6973aa32d54166fdec35558c https://git.kernel.org/stable/c/7d56ba306e93d04696718963fb4cda2883ee7585 https://git.kernel.org/stable/c/8b5ed7c5417b7013d35b6f2507dab739013ba1a9 https://git.kernel.org/stable/c/9769a09afda20a006b528b9e723effcae45965b2 https://git.kernel.org/stable/c/9c3398e5b3a914b74276d44ab54c49123b89c61a https://git.kernel.org/stable/c/b7605b9301abc18fbbf2b0e23fdd281fc768955d

Frequently Asked Questions

What is CVE-2026-46249? +

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Fix PF driver crash with kexec kernel booting During a kexec reboot the hardware is not power-cycled, so AF state from the old kernel can persist into the new kernel. When AF and PF drivers are built as modules, the PF driver may probe before AF reinitializes the hardware. The PF driver treats the RVUM block revision as an indication that AF initialization is complete. If this value is left uncleared at shutdown, PF may incorrectly assume AF is ready and access stale hardware state, leading to a crash. Clear the RVUM block revision during AF shutdown to avoid PF mis-detecting AF readiness after kexec. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2026-46249? +

CVE-2026-46249 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0012, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-46249? +

CVE-2026-46249 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-46249? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-9588 10.0

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. …

CVE-2025-57870 10.0

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This …

CVE-2026-48286 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2026-13782 10.0

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer …

CVE-2025-34028 10.0

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when …

CVE-2026-48303 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result …