PT-2026-5520 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-04-20 · CVE-2026-23017

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s idpf driver related to error handling within the init task during driver loading. If the init task fails, the system may lack necessary virtual ports and network devices, leading to a crash upon subsequent reset attempts as the service task attempts to access uninitialized resources. The issue manifests as a kernel NULL pointer dereference when the CREATE VPORT operation (op 501) is rejected by the firmware. The fix involves improving error handling in the init task to disable service and mailbox tasks if an error occurs during loading. The PTP callbacks are also stopped to prevent issues during a successful reset. The vulnerable function is idpf vc event task.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-23017

OPENSUSE-SU-2026:20416-1

SUSE-SU-2026:0962-1

SUSE-SU-2026:1081-1

SUSE-SU-2026:20667-1

SUSE-SU-2026:20720-1

SUSE-SU-2026:20838-1

SUSE-SU-2026:20845-1

SUSE-SU-2026:20876-1

SUSE-SU-2026:20931-1

SUSE-SU-2026:21284-1

Affected Products

Linux Kernel

References · 1571

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23017.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23017 · Vendor Advisory
• https://git.kernel.org/stable/c/4d792219fe6f891b5b557a607ac8a0a14eda6e38 · Patch
• https://ubuntu.com/security/CVE-2026-23017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23017 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:20720-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20416-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-23017 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23017 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20876-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23017 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23017 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20931-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20845-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-23017 · Vendor Advisory