CVE-2026-43094
NULL Pointer Dereference in ixgbevf Hyper-V Driver
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| intel | ixgbevf | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ixgbevf driver, specifically in its handling of Hyper-V virtual machines. The issue is that a function pointer called negotiate_features was added to some operation tables but was mistakenly left NULL in the Hyper-V operations table (ixgbevf_hv_mac_ops).
When the driver probes the hardware, it calls a function that unconditionally dereferences this NULL pointer on Hyper-V VMs, causing a kernel NULL pointer dereference (a crash).
The fix involved adding a proper negotiate_features callback for Hyper-V that returns an error code handled gracefully by the caller, preventing the NULL pointer dereference.
How can this vulnerability impact me? :
This vulnerability can cause a kernel NULL pointer dereference on Linux systems running the ixgbevf driver in Hyper-V virtual machines. This results in a kernel crash (BUG), which can lead to system instability or downtime.
Such crashes can disrupt services running on affected virtual machines, potentially causing data loss or interruption of critical operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a NULL pointer dereference in the ixgbevf driver on Hyper-V virtual machines, causing kernel crashes during device probe.
To detect this issue on your system, you can check your kernel logs for BUG messages related to ixgbevf and NULL pointer dereferences, especially on Hyper-V VMs.
- Use the command: dmesg | grep -i 'ixgbevf' | grep -i 'NULL pointer dereference'
- Check system logs for kernel BUG messages: journalctl -k | grep -i 'ixgbevf' | grep -i 'BUG'
- Verify if the system is running on a Hyper-V virtual machine by checking: systemd-detect-virt or dmidecode | grep -i 'Hyper-V'
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a missing function pointer in the ixgbevf driver on Hyper-V VMs, leading to kernel crashes.
Immediate mitigation steps include:
- Update the Linux kernel to a version that includes the fix which adds the missing negotiate_features callback to ixgbevf_hv_mac_ops.
- If updating the kernel is not immediately possible, consider disabling the ixgbevf driver on Hyper-V VMs to prevent the NULL pointer dereference.
- Monitor system stability and avoid using affected network interfaces until the fix is applied.