CVE-2026-46236

What it actually does

This is a local Linux kernel availability vulnerability in the media remote-control driver for Xbox remote devices. The driver used an I/O buffer embedded in a device structure in a way that violates DMA coherency requirements. A local user with access to the affected device path or the ability to interact with the relevant USB/media remote hardware path could trigger unsafe DMA behavior, potentially causing kernel memory corruption symptoms, driver malfunction, a kernel oops, panic, or system hang. The published CVSS vector indicates local access, low attack complexity, low privileges, no user interaction, and high availability impact, with no expected confidentiality or integrity impact.

Why it matters to the business

Successful exploitation can crash or destabilize affected Linux systems, interrupting workloads, appliances, kiosks, media systems, embedded devices, or servers that include and expose the affected driver. The risk is lower than remotely exploitable kernel flaws because the attacker needs local access and the vulnerability is not known to be exploited in the wild, is not in CISA KEV, is not associated with ransomware use, and has a very low EPSS score. However, systems that allow untrusted local users, container escape-adjacent hardware access, or USB/media device interaction should treat this as an availability and reliability risk.

How an attack unfolds

An attacker first obtains local low-privileged access to a Linux system running an affected kernel with the xbox_remote media remote-control driver available. They then interact with the affected hardware or device interface in a way that exercises the driver's DMA I/O path. Because the driver places a DMA-related I/O buffer inside the device structure instead of using memory that satisfies DMA coherency requirements, the kernel may observe inconsistent or unsafe memory behavior. Repeated triggering can lead to driver faults, kernel warnings, oops conditions, or a full system crash, producing a denial of service. There is no public indication from the provided data that this flaw is being actively exploited by named threat actors or ransomware campaigns.

How to fix it

Update the Linux kernel to a vendor-supported release that includes the upstream fix for the xbox_remote DMA coherency issue. Because no exact fixed versions were provided, use distribution advisories and package changelogs to identify the first kernel build that includes the fix for this CVE or the corresponding upstream media/rc/xbox_remote patch. Reboot into the updated kernel after installation and confirm the old vulnerable kernel is no longer running. Where immediate patching is not possible, reduce exposure by disabling or blacklisting the affected xbox_remote driver if it is not required, restricting local shell access to trusted users, limiting USB/hardware access, and ensuring untrusted containers or sandboxes do not receive direct access to host input/media devices.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel version is a vendor release containing the fix, not merely that updated packages are installed. Check distribution security advisories, kernel changelogs, or package metadata for the CVE or the xbox_remote DMA coherency patch. Validate exposure by checking whether the affected driver is present or loaded, such as with kernel module listings and driver files under the running kernel's module tree. If the driver is not needed, confirm it is blacklisted or unavailable after reboot. Operational validation should include reviewing kernel logs after reboot and after normal device activity to ensure there are no recurring xbox_remote, DMA, USB, media rc, oops, or panic messages.

Typical attack path

1. Gain local low-privileged access to a Linux system running an affected kernel.
2. Confirm that the affected Xbox remote/media remote-control driver is present, loaded, or loadable.
3. Access or attach compatible hardware or otherwise trigger the relevant media remote-control input path.
4. Exercise the driver's DMA I/O handling path repeatedly or with malformed/unexpected device behavior.
5. Cause kernel instability such as an oops, panic, hang, or forced reboot, resulting in denial of service.

How to detect it

To determine whether exploitation or triggering already occurred, review kernel and system logs for the period of interest, especially journalctl, dmesg output, /var/log/kern.log, /var/log/messages, /var/log/syslog, crash dump records, and system reboot histories. Look for xbox_remote driver activity followed by DMA warnings, USB/media remote errors, kernel oops messages, panics, hangs, watchdog resets, or unexplained reboots. Correlate these events with local user sessions, physical or virtual USB device attachment events, module load events, and access to input/media device nodes. If kernel crash dumping is enabled, examine vmcore, kdump, or apport/abrt crash artifacts for stack traces involving the xbox_remote driver, media remote-control subsystem, USB input handling, DMA mapping/coherency warnings, or general protection faults. There are no known network indicators for this local denial-of-service issue, and absence of logs does not rule out exploitation if the system crashed before logs were flushed.

• xbox_remote
• rc_core
• media: rc
• DMA coherency
• DMA-API
• kernel BUG
• BUG: unable to handle kernel
• Oops:
• Kernel panic
• general protection fault
• watchdog: BUG: soft lockup
• watchdog: hard LOCKUP
• usbcore
• usb
• /var/log/kern.log
• /var/log/messages
• /var/log/syslog
• /proc/modules
• /lib/modules/
• /etc/modprobe.d/

What your security team should do

• Prioritize patching affected Linux systems that permit untrusted local users, shared shell access, physical USB access, or direct access to input/media devices.
• Update to a vendor-supported fixed kernel and reboot; verify the running kernel, not just the installed package version.
• If the Xbox remote/media remote-control driver is unnecessary, disable or blacklist it as a compensating control.
• Restrict local device access and avoid passing host USB/input/media devices into untrusted containers or virtualized workloads.
• Monitor kernel logs for crashes, oops events, DMA warnings, and xbox_remote driver activity until patching is complete.
• Treat exploitation indicators as availability-focused: unexpected reboots, kernel panics, hangs, and repeated driver faults are more relevant than data-theft artifacts.
• Because this issue is not KEV-listed, not known to be used in ransomware, has no known exploit maturity, and has very low EPSS, schedule remediation according to local kernel patch SLAs unless the affected driver is exposed to untrusted local users.