{
"title": "CVE-2026-46142 libwx SR-IOV VF Hang: Small Patch, Big Virtualization Lesson",
"content": "The National Vulnerability Database published CVE-2026-46142 on May 28, 2026, a flaw that can freeze an entire physical server when a malicious virtual function (VF) reads a physical function (PF) register on Wangxun Ethernet adapters. The Linux kernel patch that fixes it spans a single line: an if (!pf) guard in the wxmboxread() function. It’s a tiny change that exposes the giant, unresolved problem of incomplete hardware isolation in SR-IOV devices—and it directly threatens Windows environments that rely on these NICs for high-speed networking.

What CVE-2026-46142 Actually Does

The bug lives in the libwx library, common code for Wangxun’s txgbe and ngbe drivers. When a guest operating system assigned a VF from one of these adapters performs an MMIO read to a register meant only for the PF, the hardware enters an unrecoverable state. No error is returned; the PCIe transaction hangs, and the NIC becomes unresponsive. In many server architectures, this hang propagates to the entire PCIe root complex, freezing the host OS or forcing a physical reset. The official CVSS 3.1 vector—AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H—scores it a 5.5 Medium, but that ‘U’ for Unchanged scope is misleading: a hanged host is a changed scope in every real-world sense.

Technically, the vulnerable path lies in mailbox communication between the VF and PF. During initialization or reset, the VF driver sends a command to retrieve device capabilities. In the broken code, wxmboxread() tries to directly read a PF register without first checking that the caller is the PF driver. The adapter’s PCIe logic then locks up because the VF’s bus-device-function ID is not authorized for that register space. The result is a classic Tx unit hang, often accompanied by NETDEV WATCHDOG: txgbe (0000:af:00.1): Tx unit hang in kernel logs—if the system can still log anything.

SR-IOV 101: Why Direct Assignment Bites Back

SR-IOV lets a single PCIe device, such as a network adapter, carve out multiple lightweight virtual functions. Each VF gets dedicated queues, interrupts, and an isolated memory region. Hypervisors like Hyper-V, KVM, or VMware can hand these VFs directly to virtual machines, bypassing the virtual switch and delivering bare-metal performance. The trade-off is that the hardware must enforce strict separation between functions. A VF should never be able to touch a PF’s registers, but not all silicon manages that. Some adapters rely on the driver to reject illegal accesses, creating a software gulf where hardware guarantees should exist. The Wangxun implementation, as exposed by this CVE, puts the burden on the kernel driver—and the kernel driver dropped it.

In the flawed code path, the VF driver inadvertently calls the same wxmboxread() routine that is normally reserved for the PF. Because the adapter does not block the access, the read proceeds and stalls. This isn’t just a theoretical risk: many production kernels enable SR-IOV with default settings that automatically probe and initialize VFs, making the attack surface immediately available to any guest with PCI passthrough privileges.

Attack Vectors and Business Impact

Exploiting this requires local access to a VF, which lowers the barrier significantly. In multi-tenant cloud environments, a single tenant who rents an instance with an SR-IOV VF can cause a denial of service for every other VM on the same physical host. Even if the hypervisor survives the hang, all traffic through the affected adapter stops. For a 100GbE NIC with 64 VFs, that’s an entire rack of production workloads suddenly air-gapped.

On-premise virtualization clusters face similar risk. An attacker who compromises one Linux guest can bring down the Hyper-V or ESXi host, dragging every other VM down with it—a noisy neighbor turned nuclear. Windows Server admins often treat SR-IOV as a performance must for network-intensive applications like SQL Server or Storage Spaces Direct. When the NIC hangs, so do the database transactions and storage replication, leading to data corruption or failover storms.

Even if the host OS doesn’t panic, the hang can trigger cascading failures. Clustered services might flap, causing split-brain scenarios. In a stretched cluster, a NIC hang on one node can force a site-level failover, sending petabytes of storage traffic over the replication link—if that link is even still up. The blast radius expands far beyond a simple device lockup.

Why Windows Shops Must Pay Attention

CVE-2026-46142 is formally a Linux kernel vulnerability, but the hardware defect it exploits is OS-agnostic. A VF assigned to a Windows guest through Hyper-V’s SR-IOV mechanism can trigger the exact same MMIO read if the guest crafts the command. The Windows PF driver (txgbe.sys or ngbe.sys) may already contain its own access checks—Wangxun has not publicly confirmed whether Windows drivers were equally exposed—but without a firmware fix, the hardware is still vulnerable. Attackers can use raw PCI access from a privileged Windows process or a purpose-built driver to issue the offending read.

Moreover, hybrid Linux-Windows environments are common. A Windows Server host might run Linux containers or a Linux VM for network functions (e.g., a virtual firewall). If that Linux VM gets a Wangxun VF and an attacker breaks into it, the resulting NIC hang will also crash the host’s Windows management OS and all other VMs. The isolation collapses irrespective of guest OS.

Cloud-managed infrastructures like Azure Stack HCI are increasingly adopting cost-optimized NICs from Wangxun and other challenger vendors for edge and branch office deployments. A single unpatched adapter in such a cluster could become a persistent DoS vector, defying the high-availability promises of the stack.

The Tiny Patch and Its Journey

The fix, committed to the Linux netdev tree on May 26, 2026, is almost embarrassingly small:

c static int wxmboxread(struct wx_adapter adapter, u32 mbox, u32 val) { + if (!adapter->pf) + return -EPERM; / existing register read logic / + }

That’s it. The adapter’s pf pointer is only set for the physical function driver; VF drivers leave it NULL. Adding this check blocks any VF from entering the privileged code path. The patch was backported to stable kernels 6.6.35, 6.12.13, and 6.18.2, and enterprise distributions from Red Hat, Canonical, and SUSE have shipped updates as of early June.

For Windows, the fix is a firmware update. Wangxun released firmware version 2.7.1 for its T-Series (10G/25G) and M-Series (100G) adapters on June 1, 2026. This firmware enforces hardware-level protection: any MMIO read from a VF targeting a PF register now returns all-ones (0xFFFFFFFF) and logs an error instead of hanging. The updated Windows driver, version 3.2.6, integrates with this firmware correctly. If you cannot apply the firmware immediately, Wangxun’s advisory recommends disabling SR