In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown

epf_ntb_epc_destroy() duplicates the teardown that the caller is
supposed to do later. This leads to an oops when .allow_link fails or
when .drop_link is performed. Remove the helper.

Also drop pci_epc_put(). EPC device refcounting is tied to configfs EPC
group lifetime, and pci_epc_put() in the .drop_link path is sufficient.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
8b821cf761503b80d0bd052f932adfe1bc1a0088 affected < 72099f015d3c77bf2eb703d1aab113bd7a60915a
8b821cf761503b80d0bd052f932adfe1bc1a0088 affected < 756ca5e7ed22d9045bb4de4c981f9149278d5cd3
8b821cf761503b80d0bd052f932adfe1bc1a0088 affected < 65fc57c8b8f0b31be62be291cb1bb01755cec85d
8b821cf761503b80d0bd052f932adfe1bc1a0088 affected < e813c95e4c8edd31599081e6356e20ada30e266d
8b821cf761503b80d0bd052f932adfe1bc1a0088 affected < 3446beddba450c8d6f9aca2f028712ac527fead3
Linux Linux affected
Version Status Constraints
5.12 affected —
0 unaffected < 5.12
6.6.140 unaffected ≤ 6.6.*
6.12.86 unaffected ≤ 6.12.*
6.18.27 unaffected ≤ 6.18.*
7.0.4 unaffected ≤ 7.0.*
7.1-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/3446beddba450c8d6f9aca2f028712ac527fead3 cve-icon cve-icon
https://git.kernel.org/stable/c/65fc57c8b8f0b31be62be291cb1bb01755cec85d cve-icon cve-icon
https://git.kernel.org/stable/c/72099f015d3c77bf2eb703d1aab113bd7a60915a cve-icon cve-icon
https://git.kernel.org/stable/c/756ca5e7ed22d9045bb4de4c981f9149278d5cd3 cve-icon cve-icon
https://git.kernel.org/stable/c/e813c95e4c8edd31599081e6356e20ada30e266d cve-icon cve-icon
History

Wed, 27 May 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Wed, 27 May 2026 14:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown epf_ntb_epc_destroy() duplicates the teardown that the caller is supposed to do later. This leads to an oops when .allow_link fails or when .drop_link is performed. Remove the helper. Also drop pci_epc_put(). EPC device refcounting is tied to configfs EPC group lifetime, and pci_epc_put() in the .drop_link path is sufficient.
Title PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-27T12:56:09.581Z

Reserved: 2026-05-13T15:03:33.092Z

Link: CVE-2026-46009

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:18.710

Modified: 2026-05-27T14:48:03.013

Link: CVE-2026-46009

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T17:00:17Z

Weaknesses