PT-2026-4485 · Linux · Linux Kernel

Published

2026-01-01

·

Updated

2026-04-20

·

CVE-2026-22985

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description The Linux kernel contains a flaw within the idpf driver related to RSS LUT initialization. Specifically, the RSS LUT is not initialized until an interface is active, leading to a NULL pointer dereference crash when ethtool operations, such as disabling rxhash, are performed before the interface is brought up. The issue is resolved by moving RSS LUT initialization to vport creation, ensuring the LUT is always available. This allows RSS configuration via ethtool before interface activation. The driver now maintains all changes in a soft copy and programs zeros to the indirection table when rxhash is disabled, deferring hardware programming until the interface is active. The vulnerability can be triggered by loading the idpf driver and then attempting to disable rxhash on an interface before bringing it up using the command ethtool -K eth2 rxhash off. The crash involves a NULL pointer dereference in the memcpy orig function, as indicated by the kernel log.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

Related Identifiers

CVE-2026-22985
OPENSUSE-SU-2026:20287-1
SUSE-SU-2026:0447-1
SUSE-SU-2026:0472-1
SUSE-SU-2026:0587-1
SUSE-SU-2026:20477-1
SUSE-SU-2026:20498-1
SUSE-SU-2026:20555-1
SUSE-SU-2026:20599-1
SUSE-SU-2026:20615-1
SUSE-SU-2026:20845-1
SUSE-SU-2026:20876-1

Affected Products

Linux Kernel