CVE-2026-23054
Improper RSS Hash Key Validation in Linux netvsc Causes Hang
Publication date: 2026-02-04
Last updated on: 2026-02-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's hv_netvsc network driver. It occurs because the driver accepts RSS (Receive Side Scaling) hash key updates even when the device does not have a valid RX indirection table allocated. Specifically, when the device reports only a single receive queue, the function rndis_filter_device_add() does not allocate this table. Accepting RSS hash key updates in this state causes the system to hang.
The fix involves modifying the netvsc_set_rxfh() function to check for the presence of the RX indirection table size (ndc->rx_table_sz) and return an error (-EOPNOTSUPP) if the table is absent. This ensures that RSS hash key programming is only allowed when the device supports it, preventing the hang.
How can this vulnerability impact me? :
This vulnerability can cause the affected Linux system to hang when RSS hash key updates are applied without a valid RX indirection table. A system hang can lead to denial of service, disrupting network operations and potentially requiring a system reboot to recover.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by ensuring that RSS hash key programming is only accepted when a valid RX indirection table is present. To mitigate this vulnerability immediately, update your Linux kernel to a version that includes the fix which gates netvsc_set_rxfh() on the presence of the RX indirection table and returns -EOPNOTSUPP when the table is absent.