Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2026-46156

5.5 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() The switch case in loongson_gpu_fixup_dma_hang() may not DC2 or D…

Published May 28, 2026CWE-667EPSS 0.13%

Overview

CVE-2026-46156 is a medium-severity vulnerability. It was published on May 28, 2026 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()

The switch case in loongson_gpu_fixup_dma_hang() may not DC2 or DC3, and

readl(crtc_reg) will access with random address, because the "device" is

from "base+PCI_DEVICE_ID", "base" is from "pdev->devfn+1". This is wrong

when my platform inserts a discrete GPU:

lspci -tv

-[0000:00]-+-00.0 Loongson Technology LLC Hyper Transport Bridge Controller

...

+-06.0 Loongson Technology LLC LG100 GPU

+-06.2 Loongson Technology LLC Device 7a37

...

Add a default switch case to fix the panic as below:

Kernel ade access[#1]:

CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.136-loong64-desktop-hwe+ #4

pc 90000000017e5534 ra 90000000017e54c0 tp 90000001002f8000 sp 90000001002fb6c0

a0 80000efe00003100 a1 0000000000003100 a2 0000000000000000 a3 0000000000000002

a4 90000001002fb6b4 a5 900000087cdb58fd a6 90000000027af000 a7 0000000000000001

t0 000

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/07d190e4ec689d6478f7f5e36099fb9bf457e7c5Refgit.kernel.org/stable/c/2cb19b06c09983727573bbe7d7430cbad480a714Refgit.kernel.org/stable/c/81fef1c278436e6bd68ee4ca05a0acb96e256561Refgit.kernel.org/stable/c/8dfa2f8780e486d05b9a0ffce70b8f5fbd62053eRefgit.kernel.org/stable/c/9e1aed63a5552958ef2a9bfd699a3f990e52a77fRefgit.kernel.org/stable/c/bfde8accc3e3260c0ecbb8cc34361739e1e16f31

How CyberStrike helps

Frequently asked questions

What is CVE-2026-46156?

CVE-2026-46156 is a medium-severity vulnerability. It was published on May 28, 2026 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2026-46156?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-46156?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-46156?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-46156 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999