PT-2026-4662 · Linux+2 · Linux Kernel+2

Published 2026-01-01 · Updated 2026-05-22 · CVE-2026-23000

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the mlx5e netdev change profile function. A failure to attach a new profile during a profile change rollback can lead to a dangling netdev with a reset netdev priv. Subsequent attempts to change the profile, such as through switchdev mode changes, can then cause a kernel crash due to accessing a NULL pointer. The issue occurs when the function fails to rollback to the original profile, resulting in an invalid priv pointer. The fix involves handling previous failures and empty priv values within mlx5e netdev change profile, and passing netdev and mdev to all flows requiring the function, avoiding the use of priv.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

AZL-77343

AZL-78324

BDU:2026-01055

CVE-2026-23000

ECHO-9AB4-587B-35DE

OESA-2026-1759

OESA-2026-1760

OESA-2026-1761

OPENSUSE-SU-2026:20287-1

SUSE-SU-2026:0447-1

SUSE-SU-2026:0472-1

SUSE-SU-2026:0587-1

SUSE-SU-2026:20477-1

SUSE-SU-2026:20498-1

SUSE-SU-2026:20555-1

SUSE-SU-2026:20599-1

SUSE-SU-2026:20615-1

SUSE-SU-2026:20845-1

SUSE-SU-2026:20876-1

USN-8278-1

USN-8289-1

USN-8296-1

Affected Products

Linux Kernel

Ubuntu

Mlx5E

References · 1938

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23000.json · Exploit
• https://ubuntu.com/security/CVE-2026-23083 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23148 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23123 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40149 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-23000 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68309 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23138 · Security Note
• https://ubuntu.com/security/CVE-2025-71184 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23038 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40359 · Security Note
• https://ubuntu.com/security/CVE-2026-23136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40272 · Security Note