CVE-2026-22993
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-04-02
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.7 (inc) to 6.18.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's idpf driver where, after a soft reset, the RSS LUT (Receive Side Scaling Lookup Table) is freed but not restored unless the network interface is up. If an ethtool command tries to access the RSS LUT immediately after the reset, it causes a NULL pointer dereference, leading to a kernel crash. The issue arises because the RSS LUT is reset only if the queue count changes and the LUT was not user-configured; otherwise, it is left untouched, which can cause invalid memory access.
How can this vulnerability impact me? :
This vulnerability can cause a kernel NULL pointer dereference, resulting in a kernel crash (Oops) when certain ethtool commands are run immediately after a soft reset that changes the queue count. This can lead to system instability or denial of service on affected Linux systems using the idpf driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reproducing the conditions that cause the issue and observing for a kernel NULL pointer dereference error. The steps include bringing the network interface down, updating the queue count, and then attempting to display the RSS LUT. The commands are: 1. Bring the interface down: ifconfig eth1 down 2. Update the queue count: ethtool -L eth1 combined 20 3. Display the RSS LUT: ethtool -x eth1 If the system logs show kernel NULL pointer dereference errors after these commands, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves ensuring that after a soft reset, the RSS LUT is only reset to default values if the reset was due to a queue count change and the LUT was not configured by the user. Avoid accessing the RSS LUT immediately after a soft reset if the interface is not up. Also, avoid resetting the RSS LUT unnecessarily if the soft reset does not involve a queue count change.