CVE-2026-22985

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

idpf: Fix RSS LUT NULL pointer crash on early ethtool operations

The RSS LUT is not initialized until the interface comes up, causing

the following NULL pointer crash when ethtool operations like rxhash on/off

are performed before the interface is brought up for the first time.

Move RSS LUT initialization from ndo_open to vport creation to ensure LUT

is always available. This enables RSS configuration via ethtool before

bringing the interface up. Simplify LUT management by maintaining all

changes in the driver's soft copy and programming zeros to the indirection

table when rxhash is disabled. Defer HW programming until the interface

comes up if it is down during rxhash and LUT configuration changes.

Steps to reproduce:

** Load idpf driver; interfaces will be created

modprobe idpf

** Before bringing the interfaces up, turn rxhash off

ethtool -K eth2 rxhash off

[89408.371875] BUG: kernel NULL pointer dereference,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References