CVE-2026-23054: net: hv_netvsc: reject RSS hash key programming without RX indirection table
In the Linux kernel, the following vulnerability has been resolved:
net: hvnetvsc: reject RSS hash key programming without RX indirection table
RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndisfilterdeviceadd() does not allocate an indirection table, accepting RSS hash key updates in this state leads to a hang.
Fix this by gating netvscsetrxfh() on ndc->rxtablesz and return -EOPNOTSUPP when the table is absent. This aligns setrxfh with the device capabilities and prevents incorrect behavior.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the hang condition?
Systems using the Linux hv_netvsc driver are exposed when the device reports a single receive queue, because no RX indirection table is allocated in that state.
What action triggers the issue?
The hang can be triggered by attempting to program or update the RSS hash key when the RX indirection table is absent.
What behavior should indicate that the fix is present?
On a device without an RX indirection table, RSS hash key programming through netvsc_set_rxfh() should be rejected with -EOPNOTSUPP rather than accepted.