CVE-2026-23206: dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: prevent ZEROSIZEPTR dereference when numifs is zero
The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc() with ethsw->swattr.numifs as the element count. When the device reports zero interfaces (either due to hardware configuration or firmware issues), kcalloc(0, ...) returns ZEROSIZEPTR (0x10) instead of NULL.
Later in dpaa2switchprobe(), the NAPI initialization unconditionally accesses ethsw->ports[0]->netdev, which attempts to dereference ZEROSIZEPTR (address 0x10), resulting in a kernel panic.
Add a check to ensure numifs is greater than zero after retrieving device attributes. This prevents the zero-sized allocations and subsequent invalid pointer dereference.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23206?
CVE-2026-23206 has a medium severity rating due to its potential for causing zero-size pointer dereference.
How do I fix CVE-2026-23206?
To fix CVE-2026-23206, update the Linux kernel to the latest stable version where this vulnerability has been resolved.
What software is affected by CVE-2026-23206?
CVE-2026-23206 affects the Linux kernel specifically in the dpaa2-switch driver.
What is the impact of CVE-2026-23206 on systems?
The impact of CVE-2026-23206 may lead to potential crashes or undefined behavior when handling zero-interface scenarios.
When was CVE-2026-23206 disclosed?
CVE-2026-23206 was disclosed in the year 2026.