The Linux kernel vulnerability (CVE-2026-46156) concerns the LoongArch architecture where the function loongson_gpu_fixup_dma_hang() contains a switch case that may not handle certain cases (DC2 or DC3) correctly. This leads to readl(crtc_reg) accessing a random address because the 'device' pointer is derived incorrectly from 'base+PCI_DEVICE_ID', with 'base' calculated from 'pdev->devfn+1'. This is incorrect when a discrete GPU is present, causing a kernel accidental double error (ADE) and panic. The fix involves adding a default switch case to prevent this panic. The vulnerability has a CVSS 3.1 score of 5.5 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The vulnerability can cause a kernel panic (availability impact) on affected systems running the Linux kernel on LoongArch architecture with discrete GPUs. There is no impact on confidentiality or integrity. The attack requires local access with low privileges and no user interaction. This could disrupt system availability but does not allow privilege escalation or data compromise.

A patch is available and should be applied by updating the Linux kernel to versions 7.0.0-28.28 or later (and other specified patched versions). After updating, a system reboot is required. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Follow the vendor advisory instructions for updating the kernel packages relevant to your Ubuntu release. No additional mitigation is required beyond applying the official fix.