CVE-2026-22985
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the idpf driver has a NULL pointer dereference bug triggered by early ethtool operations such as toggling rxhash before the interface is first brought up. The RSS LUT is not initialized until the interface comes up. The fix moves RSS LUT initialization to vport creation so the LUT is always available.
Risk Assessment
An organization may experience a kernel crash and network service unavailability if an administrator or automated system performs ethtool operations on an idpf interface before its first bring-up. This can lead to service disruption and require a system restart.
Recommendation
Update the Linux kernel to a version containing the fix for CVE-2026-22985. Until patched, avoid performing ethtool operations (e.g., rxhash changes) on idpf interfaces before their first bring-up.
Other vulnerabilities in Linux kernel idpf driver
See all- CVE-2026-22981Medium
In the Linux kernel, a bug in the idpf driver's reset handling was fixed. During a hardware or software reset, the driver de-allocated vport resources while network interfaces (netdevs) remained active and exposed to callbacks, potentially causing vport state loss or a kernel crash (NULL pointer dereference) on subsequent ifup/down.
- CVE-2025-38392Medium
In the Linux kernel, the idpf driver uses a mutex (cq_lock) in a context where sleeping is not allowed (with BH disabled), causing a 'BUG: sleeping function called from invalid context' warning on module load when VIRTCHNL2_CAP_MACFILTER is enabled. The fix converts the mutex to a spinlock and requests contiguous physical memory for the DMA mapping.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initialized until the interface comes up, causing the following NULL pointer crash when ethtool operations like rxhash on/off are performed before the interface is brought up for the first time. Move RSS LUT initialization from ndo_open to vport creation to ensure LUT is always available. This enables RSS configuration via ethtool before bringing the interface up. Simplify LUT management by maintaining all changes in the driver's soft copy and programming zeros to the indirection table when rxhash is disabled. Defer HW programming until the interface comes up if it is down during rxhash and LUT configuration changes. Steps to reproduce: ** Load idpf driver; interfaces will be created modprobe idpf ** Before bringing the interfaces up, turn rxhash off ethtool -K eth2 rxhash off [89408.371875] BUG: kernel NULL pointer dereference, address: 0000000000000000 [89408.371908] #PF: supervisor read access in kernel mode [89408.371924] #PF: error_code(0x0000) - not-present page [89408.371940] PGD 0 P4D 0 [89408.371953] Oops: Oops: 0000 [#1] SMP NOPTI <snip> [89408.372052] RIP: 0010:memcpy_orig+0x16/0x130 [89408.372310] Call Trace: [89408.372317] <TASK> [89408.372326] ? idpf_set_features+0xfc/0x180 [idpf] [89408.372363] __netdev_update_features+0x295/0xde0 [89408.372384] ethnl_set_features+0x15e/0x460 [89408.372406] genl_family_rcv_msg_doit+0x11f/0x180 [89408.372429] genl_rcv_msg+0x1ad/0x2b0 [89408.372446] ? __pfx_ethnl_set_features+0x10/0x10 [89408.372465] ? __pfx_genl_rcv_msg+0x10/0x10 [89408.372482] netlink_rcv_skb+0x58/0x100 [89408.372502] genl_rcv+0x2c/0x50 [89408.372516] netlink_unicast+0x289/0x3e0 [89408.372533] netlink_sendmsg+0x215/0x440 [89408.372551] __sys_sendto+0x234/0x240 [89408.372571] __x64_sys_sendto+0x28/0x30 [89408.372585] x64_sys_call+0x1909/0x1da0 [89408.372604] do_syscall_64+0x7a/0xfa0 [89408.373140] ? clear_bhb_loop+0x60/0xb0 [89408.373647] entry_SYSCALL_64_after_hwframe+0x76/0x7e [89408.378887] </TASK> <snip>
Vulnerability data from NVD (NIST) · CISA KEV · EPSS