CVE-2026-23206
NULL Pointer Dereference in Linux dpaa2-switch Driver Causes Kernel Panic
Publication date: 2026-02-14
Last updated on: 2026-03-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 5.16 (inc) to 6.1.163 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.70 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.124 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.10 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 5.13 (inc) to 5.15.200 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's dpaa2-switch driver. When the device reports zero interfaces (num_ifs is zero), the driver allocates arrays using kcalloc with zero elements. Instead of returning NULL, kcalloc returns a ZERO_SIZE_PTR (address 0x10). Later, the code tries to access ethsw->ports[0]->netdev unconditionally, which dereferences this ZERO_SIZE_PTR, causing a kernel panic.
The fix involves adding a check to ensure that num_ifs is greater than zero before proceeding, preventing zero-sized allocations and the invalid pointer dereference.
How can this vulnerability impact me? :
This vulnerability can cause a kernel panic due to an invalid pointer dereference when the device reports zero interfaces. A kernel panic results in a system crash, leading to denial of service and potential data loss or system instability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the Linux kernel version you are using includes the fix that adds a check to verify that num_ifs is greater than zero before proceeding with allocations and pointer dereferences in the dpaa2-switch driver.
If an updated kernel is not yet available, avoid using hardware or firmware configurations that cause the device to report zero interfaces, as this triggers the vulnerability.
Monitoring for kernel panics related to dpaa2-switch or the address 0x10 dereference may help identify if the vulnerability is being triggered.