{
  "threat_severity" : "Moderate",
  "public_date" : "2026-01-23T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations",
    "id" : "2432381",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2432381"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.2",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-476",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nidpf: Fix RSS LUT NULL pointer crash on early ethtool operations\nThe RSS LUT is not initialized until the interface comes up, causing\nthe following NULL pointer crash when ethtool operations like rxhash on/off\nare performed before the interface is brought up for the first time.\nMove RSS LUT initialization from ndo_open to vport creation to ensure LUT\nis always available. This enables RSS configuration via ethtool before\nbringing the interface up. Simplify LUT management by maintaining all\nchanges in the driver's soft copy and programming zeros to the indirection\ntable when rxhash is disabled. Defer HW programming until the interface\ncomes up if it is down during rxhash and LUT configuration changes.\nSteps to reproduce:\n** Load idpf driver; interfaces will be created\nmodprobe idpf\n** Before bringing the interfaces up, turn rxhash off\nethtool -K eth2 rxhash off\n[89408.371875] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[89408.371908] #PF: supervisor read access in kernel mode\n[89408.371924] #PF: error_code(0x0000) - not-present page\n[89408.371940] PGD 0 P4D 0\n[89408.371953] Oops: Oops: 0000 [#1] SMP NOPTI\n<snip>\n[89408.372052] RIP: 0010:memcpy_orig+0x16/0x130\n[89408.372310] Call Trace:\n[89408.372317]  <TASK>\n[89408.372326]  ? idpf_set_features+0xfc/0x180 [idpf]\n[89408.372363]  __netdev_update_features+0x295/0xde0\n[89408.372384]  ethnl_set_features+0x15e/0x460\n[89408.372406]  genl_family_rcv_msg_doit+0x11f/0x180\n[89408.372429]  genl_rcv_msg+0x1ad/0x2b0\n[89408.372446]  ? __pfx_ethnl_set_features+0x10/0x10\n[89408.372465]  ? __pfx_genl_rcv_msg+0x10/0x10\n[89408.372482]  netlink_rcv_skb+0x58/0x100\n[89408.372502]  genl_rcv+0x2c/0x50\n[89408.372516]  netlink_unicast+0x289/0x3e0\n[89408.372533]  netlink_sendmsg+0x215/0x440\n[89408.372551]  __sys_sendto+0x234/0x240\n[89408.372571]  __x64_sys_sendto+0x28/0x30\n[89408.372585]  x64_sys_call+0x1909/0x1da0\n[89408.372604]  do_syscall_64+0x7a/0xfa0\n[89408.373140]  ? clear_bhb_loop+0x60/0xb0\n[89408.373647]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[89408.378887]  </TASK>\n<snip>" ],
  "statement" : "A NULL-pointer dereference in the Intel idpf driver can be triggered when early ethtool operations (e.g., toggling rxhash) are performed before the interface is brought up, because the RSS LUT was not initialized yet. This leads to a kernel crash (DoS) via the netlink/feature-change path.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-22985\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22985\nhttps://lore.kernel.org/linux-cve-announce/2026012349-CVE-2026-22985-9a80@gregkh/T" ],
  "name" : "CVE-2026-22985",
  "csaw" : false
}