Linux kernel idpf driver vulnerabilities
3 known CVE vulnerabilities in Linux kernel idpf driver, translated and rated.
- CVE-2026-22985Medium
In the Linux kernel, the idpf driver has a NULL pointer dereference bug triggered by early ethtool operations such as toggling rxhash before the interface is first brought up. The RSS LUT is not initialized until the interface comes up. The fix moves RSS LUT initialization to vport creation so the LUT is always available.
- CVE-2026-22981Medium
In the Linux kernel, a bug in the idpf driver's reset handling was fixed. During a hardware or software reset, the driver de-allocated vport resources while network interfaces (netdevs) remained active and exposed to callbacks, potentially causing vport state loss or a kernel crash (NULL pointer dereference) on subsequent ifup/down.
- CVE-2025-38392Medium
In the Linux kernel, the idpf driver uses a mutex (cq_lock) in a context where sleeping is not allowed (with BH disabled), causing a 'BUG: sleeping function called from invalid context' warning on module load when VIRTCHNL2_CAP_MACFILTER is enabled. The fix converts the mutex to a spinlock and requests contiguous physical memory for the DMA mapping.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

