{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-46287 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-46287 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-46287 and fix it if it is affected.\n\nWhat it is: CVE-2026-46287 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-46287 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-46287/ (Markdown: https://insights.sbomify.com/CVE-2026-46287/index.md)","id":"CVE-2026-46287","markdown":"https://insights.sbomify.com/CVE-2026-46287/index.md","name":"CVE-2026-46287","record":{"aliases":["AZL-89655","BELL-CVE-2026-46287","DEBIAN-CVE-2026-46287","GHSA-pqmq-qjcg-mw2v","UBUNTU-CVE-2026-46287"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A missing lock in the txgbe network driver causes a kernel warning and potential instability when removing the module, requiring a patch.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-617","name":"Reachable Assertion"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: txgbe: fix RTNL assertion warning when remove module\n\nFor the copper NIC with external PHY, the driver called\nphylink_connect_phy() during probe and phylink_disconnect_phy() during\nremove. It caused an RTNL assertion warning in phylink_disconnect_phy()\nupon module remove.\n\nTo fix this, add rtnl_lock() and rtnl_unlock() around the\nphylink_disconnect_phy() in remove function.\n\n ------------[ cut here ]------------\n RTNL: assertion failed at drivers/net/phy/phylink.c (2351)\n WARNING: drivers/net/phy/phylink.c:2351 at\nphylink_disconnect_phy+0xd8/0xf0 [phylink], CPU#0: rmmod/4464\n Modules linked in: ...\n CPU: 0 UID: 0 PID: 4464 Comm: rmmod Kdump: loaded Not tainted 7.0.0-rc4+\n Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING\nPLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024\n RIP: 0010:phylink_disconnect_phy+0xe4/0xf0 [phylink]\n Code: 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 f6 31 ff e9 3a 38 8f e7\n48 8d 3d 48 87 e2 ff ba 2f 09 00 00 48 c7 c6 c1 22 24 c0 \u003c67\u003e 48 0f b9 3a\ne9 34 ff ff ff 66 90 90 90 90 90 90 90 90 90 90 90\n RSP: 0018:ffffce7288363ac0 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: ffff89654b2a1a00 RCX: 0000000000000000\n RDX: 000000000000092f RSI: ffffffffc02422c1 RDI: ffffffffc0239020\n RBP: ffffce7288363ae8 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffff8964c4022000\n R13: ffff89654fce3028 R14: ffff89654ebb4000 R15: ffffffffc0226348\n FS:  0000795e80d93780(0000) GS:ffff896c52857000(0000)\nknlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00005b528b592000 CR3: 0000000170d0f000 CR4: 0000000000f50ef0\n PKRU: 55555554\n Call Trace:\n  \u003cTASK\u003e\n  txgbe_remove_phy+0xbb/0xd0 [txgbe]\n  txgbe_remove+0x4c/0xb0 [txgbe]\n  pci_device_remove+0x41/0xb0\n  device_remove+0x43/0x80\n  device_release_driver_internal+0x206/0x270\n  driver_detach+0x4a/0xa0\n  bus_remove_driver+0x83/0x120\n  driver_unregister+0x2f/0x60\n  pci_unregister_driver+0x40/0x90\n  txgbe_driver_exit+0x10/0x850 [txgbe]\n  __do_sys_delete_module.isra.0+0x1c3/0x2f0\n  __x64_sys_delete_module+0x12/0x20\n  x64_sys_call+0x20c3/0x2390\n  do_syscall_64+0x11c/0x1500\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? do_syscall_64+0x15a/0x1500\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? do_fault+0x312/0x580\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? __handle_mm_fault+0x9d5/0x1040\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? count_memcg_events+0x101/0x1d0\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? handle_mm_fault+0x1e8/0x2f0\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? do_user_addr_fault+0x2f8/0x820\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? irqentry_exit+0xb2/0x600\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? exc_page_fault+0x92/0x1c0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"net: txgbe: fix RTNL assertion warning when remove module","id":"CVE-2026-46287","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"of: unittest: fix use-after-free in of_unittest_changeset()","id":"CVE-2026-46288"},"packages":[],"prev":{"headline":"leds: qcom-lpg: Check for array overflow when selecting the high resolution","id":"CVE-2026-46286"},"products":["Linux"],"published":"2026-06-08","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-06-14","vendors":["Linux"]},"summary":"A missing lock in the txgbe network driver causes a kernel warning and potential instability when removing the module, requiring a patch.","url":"https://insights.sbomify.com/CVE-2026-46287/"}