PT-2026-37404 · Linux · Linux

Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-43094

Mitre

In the Linux kernel, the following vulnerability has been resolved:

ixgbevf: add missing negotiate features op to Hyper-V ops table

Commit a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by negotiating supported features") added the .negotiate features callback to ixgbe mac operations and populated it in ixgbevf mac ops, but forgot to add it to ixgbevf hv mac ops. This leaves the function pointer NULL on Hyper-V VMs.

During probe, ixgbevf negotiate api() calls ixgbevf set features(), which unconditionally dereferences hw->mac.ops.negotiate features(). On Hyper-V this results in a NULL pointer dereference:

BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine [...] Workqueue: events work for cpu fn RIP: 0010:0x0 [...] Call Trace: ixgbevf negotiate api+0x66/0x160 [ixgbevf] ixgbevf sw init+0xe4/0x1f0 [ixgbevf] ixgbevf probe+0x20f/0x4a0 [ixgbevf] local pci probe+0x50/0xa0 work for cpu fn+0x1a/0x30 [...]

Add ixgbevf hv negotiate features vf() that returns -EOPNOTSUPP and wire it into ixgbevf hv mac ops. The caller already handles -EOPNOTSUPP gracefully.

Related Identifiers

CVE-2026-43094

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-43094 · Security Note
• https://git.kernel.org/stable/c/d8a747057a17ffc79e31df1abb11d05e1669d8e5 · Note
• https://git.kernel.org/stable/c/4821d563cd7f251ae728be1a6d04af82a294a5b9 · Note
• https://git.kernel.org/stable/c/2270ebab53128fb73c4a70a292be09094074737f · Note
• https://git.kernel.org/stable/c/1455ff8809843e6e83f1f5b5c0bcc2224c99a3cb · Note
• https://git.kernel.org/stable/c/4db7b61ec1d1b2b67c0881b62fc4f9583bc21484 · Note