Medium 5.5Published May 28, 2026

CVE-2026-46236media: rc: xbox_remote: heed DMA restrictions

Updated under an hour ago (Oct 27, 2026, 4:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: rc: xbox_remote: heed DMA restrictions The buffer for IO must not be part of the device structure because that violates the DMA coherency rules.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 02d32bdad3123d7376244256936a6b3b6ee434e8 before 465d27ab83692167f06a6f917bdfd0a0d4fc8ff3; from 02d32bdad3123d7376244256936a6b3b6ee434e8 before e0301883ec779c21158a3923b2eb666074fa976e; 02d32bdad3123d7376244256936a6b3b6ee434e8 builds before 0ea67a135335e51be50e83ee4cc99560b8b89c25; 02d32bdad3123d7376244256936a6b3b6ee434e8 builds before 0cc9251833bf02c8c7863404157c94dab5928fcf; from 02d32bdad3123d7376244256936a6b3b6ee434e8 before 48a668c22e8f92637bc496e84d1cf06900f74a5c; from 02d32bdad3123d7376244256936a6b3b6ee434e8 before 63a960b39de9c51f29ca19aa5067934f865c0bc7; 02d32bdad3123d7376244256936a6b3b6ee434e8 builds before 0bd8ac88ec5f74cd0f4b8cfc54f4cc0827007249; from 02d32bdad3123d7376244256936a6b3b6ee434e8 before e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff	CNA record
linux linux_kernel linux:linux_kernel	from 5.0 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.90; from 6.13 before 6.18.32; from 6.19 before 7.0.9	NVD

References

References

https://git.kernel.org/stable/c/465d27ab83692167f06a6f917bdfd0a0d4fc8ff3	patch
https://git.kernel.org/stable/c/e0301883ec779c21158a3923b2eb666074fa976e	patch
https://git.kernel.org/stable/c/0ea67a135335e51be50e83ee4cc99560b8b89c25	patch
https://git.kernel.org/stable/c/0cc9251833bf02c8c7863404157c94dab5928fcf	patch
https://git.kernel.org/stable/c/48a668c22e8f92637bc496e84d1cf06900f74a5c	patch
https://git.kernel.org/stable/c/63a960b39de9c51f29ca19aa5067934f865c0bc7	patch
https://git.kernel.org/stable/c/0bd8ac88ec5f74cd0f4b8cfc54f4cc0827007249	patch
https://git.kernel.org/stable/c/e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.