CVE-2026-22993

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

idpf: Fix RSS LUT NULL ptr issue after soft reset

During soft reset, the RSS LUT is freed and not restored unless the

interface is up. If an ethtool command that accesses the rss lut is

attempted immediately after reset, it will result in NULL ptr

dereference. Also, there is no need to reset the rss lut if the soft reset

does not involve queue count change.

After soft reset, set the RSS LUT to default values based on the updated

queue count only if the reset was a result of a queue count change and

the LUT was not configured by the user. In all other cases, don't touch

the LUT.

Steps to reproduce:

** Bring the interface down (if up)

ifconfig eth1 down

** update the queue count (eg., 27->20)

ethtool -L eth1 combined 20

** display the RSS LUT

ethtool -x eth1

[82375.558338] BUG: kernel NULL pointer dereference, address: 0000000000000000

[82375.558373] #PF: supervisor read access in kernel mode

[82375.558391] #PF:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References