CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list
In the Linux kernel, the following vulnerability has been resolved:
be2net: Fix NULL pointer dereference in becmdgetmacfromlist
When the parameter pmacidvalid argument of becmdgetmacfromlist() is set to false, the driver may request the PMACID from the firmware of the network card, and this function will store that PMACID at the provided address pmacid. This is the contract of this function.
However, there is a location within the driver where both pmacidvalid == false and pmacid == NULL are being passed. This could result in dereferencing a NULL pointer.
To resolve this issue, it is necessary to pass the address of a stub variable to the function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23084?
CVE-2026-23084 has been classified as a high severity vulnerability due to its potential impact on system stability.
How do I fix CVE-2026-23084?
To fix CVE-2026-23084, update your Linux kernel to the latest version where this vulnerability has been addressed.
What systems are affected by CVE-2026-23084?
CVE-2026-23084 affects the Linux kernel, particularly systems using the be2net driver.
What kind of attack can exploit CVE-2026-23084?
CVE-2026-23084 can be exploited through local denial-of-service attacks resulting from a NULL pointer dereference.
Is there a workaround for CVE-2026-23084?
While updating the kernel is the recommended solution for CVE-2026-23084, limiting the use of the be2net driver may serve as a temporary workaround.