UBUNTU-CVE-2026-22985: Null Pointer Dereference

Q: Which systems are exposed to this crash condition?

Systems using the idpf driver are exposed when an idpf interface has been created but has not yet been brought up for the first time. The affected Ubuntu kernel package variants listed are linux-gcp, linux-riscv, linux-realtime, linux-azure, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.

Q: What is required to trigger the issue?

An attacker or local user needs high privileges and the ability to perform ethtool RSS configuration on an idpf interface before it is first brought up. Disabling rxhash with ethtool in that state can dereference an uninitialized RSS lookup table and crash the kernel.

Q: Are interfaces affected while they are down?

Yes. The vulnerable condition specifically occurs before the interface has been brought up for the first time, because the RSS LUT is not initialized until interface activation. The fix makes the LUT available at virtual-port creation and defers hardware programming while an interface remains down.

Q: What can be done if the kernel cannot be updated immediately?

Avoid changing rxhash or RSS indirection-table settings with ethtool on idpf interfaces before they have been brought up at least once. Restrict access to privileged network administration operations for users who do not need them.

Published Jan 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initialized until the interface comes up, causing the following NULL pointer crash when ethtool operations like rxhash on/off are performed before the interface is brought up for the first time. Move RSS LUT initialization from ndoopen to vport creation to ensure LUT is always available. This enables RSS configuration via ethtool before bringing the interface up. Simplify LUT management by maintaining all changes in the driver's soft copy and programming zeros to the indirection table when rxhash is disabled. Defer HW programming until the interface comes up if it is down during rxhash and LUT configuration changes. Steps to reproduce: Load idpf driver; interfaces will be created modprobe idpf Before bringing the interfaces up, turn rxhash off ethtool -K eth2 rxhash off [89408.371875] BUG: kernel NULL pointer dereference, address: 0000000000000000 [89408.371908] #PF: supervisor read access in kernel mode [89408.371924] #PF: errorcode(0x0000) - not-present page [89408.371940] PGD 0 P4D 0 [89408.371953] Oops: Oops: 0000 [#1] SMP NOPTI <snip> [89408.372052] RIP: 0010:memcpyorig+0x16/0x130 [89408.372310] Call Trace: [89408.372317] <TASK> [89408.372326] ? idpfsetfeatures+0xfc/0x180 [idpf] [89408.372363] netdevupdatefeatures+0x295/0xde0 [89408.372384] ethnlsetfeatures+0x15e/0x460 [89408.372406] genlfamilyrcvmsgdoit+0x11f/0x180 [89408.372429] genlrcvmsg+0x1ad/0x2b0 [89408.372446] ? pfxethnlsetfeatures+0x10/0x10 [89408.372465] ? pfxgenlrcvmsg+0x10/0x10 [89408.372482] netlinkrcvskb+0x58/0x100 [89408.372502] genlrcv+0x2c/0x50 [89408.372516] netlinkunicast+0x289/0x3e0 [89408.372533] netlinksendmsg+0x215/0x440 [89408.372551] syssendto+0x234/0x240 [89408.372571] x64syssendto+0x28/0x30 [89408.372585] x64syscall+0x1909/0x1da0 [89408.372604] dosyscall64+0x7a/0xfa0 [89408.373140] ? clearbhbloop+0x60/0xb0 [89408.373647] entrySYSCALL64afterhwframe+0x76/0x7e [89408.378887] </TASK> <snip>

Affected Software

153 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1061.64~22.04.1

6.8.0-1061.64~22.04.1

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1063.71~22.04.1

6.8.0-1063.71~22.04.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1062.69~22.04.1

6.8.0-1062.69~22.04.1

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1064.72~22.04.1

6.8.0-1064.72~22.04.1

ubuntu/linux-gke*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-136.136~22.04.1

6.8.0-136.136~22.04.1

ubuntu/linux-ibm-6.8<6.8.0-1061.62~22.04.1

6.8.0-1061.62~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-136.136.2~22.04.1

6.8.0-136.136.2~22.04.1

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1059.62~22.04.1

6.8.0-1059.62~22.04.1

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1058.61~22.04.1

6.8.0-1058.61~22.04.1

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-136.136~22.04.3

6.8.0-136.136~22.04.3

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8<6.8.1-1056.57~22.04.2

6.8.1-1056.57~22.04.2

ubuntu/linux-gcp-fips*

ubuntu/linux<6.8.0-136.136

6.8.0-136.136

ubuntu/linux-aws<6.8.0-1061.64

6.8.0-1061.64

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-azure<6.8.0-1063.71

6.8.0-1063.71

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17<6.17.0-1021.21~24.04.1

6.17.0-1021.21~24.04.1

ubuntu/linux-azure-fde<6.8.0-1062.69

6.8.0-1062.69

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1064.72

6.8.0-1064.72

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-6.17<6.17.0-1021.24~24.04.1

6.17.0-1021.24~24.04.1

ubuntu/linux-gke<6.8.0-1059.67

6.8.0-1059.67

ubuntu/linux-gkeop<6.8.0-1046.50

6.8.0-1046.50

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17<6.17.0-41.41~24.04.1

6.17.0-41.41~24.04.1

ubuntu/linux-ibm<6.8.0-1061.62

6.8.0-1061.62

ubuntu/linux-lowlatency<6.8.0-136.136.2

6.8.0-136.136.2

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1059.62

6.8.0-1059.62

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1031.31

6.17.0-1031.31

ubuntu/linux-nvidia-lowlatency<6.8.0-1059.62.1

6.8.0-1059.62.1

ubuntu/linux-nvidia-tegra<6.8.0-1030.31

6.8.0-1030.31

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17<6.17.0-1030.30

6.17.0-1030.30

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1058.61

6.8.0-1058.61

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17<6.17.0-1019.19~24.04.3

6.17.0-1019.19~24.04.3

ubuntu/linux-raspi<6.8.0-1061.65

6.8.0-1061.65

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-xilinx<6.8.0-1033.34

6.8.0-1033.34

ubuntu/linux-bluefield<6.8.0-1028.33

6.8.0-1028.33

ubuntu/linux-raspi-realtime<6.8.0-2050.52

6.8.0-2050.52

ubuntu/linux-realtime<6.8.1-1056.57

6.8.1-1056.57

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17<6.17.0-1018.20~24.04.1

6.17.0-1018.20~24.04.1

ubuntu/linux-aws-fips<6.8.0-1061.64+fips1

6.8.0-1061.64+fips1

ubuntu/linux-azure-fips<6.8.0-1063.71+fips2

6.8.0-1063.71+fips2

ubuntu/linux-fips<6.8.0-136.136+fips2

6.8.0-136.136+fips2

ubuntu/linux-gcp-fips<6.8.0-1064.72+fips1

6.8.0-1064.72+fips1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp*

ubuntu/linux-oracle*

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.64~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.62~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136.2~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.62~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136~22.04.3
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1056.57~22.04.2
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.64
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71
Upgrade
Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1021.21~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72
Upgrade
Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1021.24~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.67
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.50
Upgrade
Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-41.41~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.62
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136.2
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.62
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1031.31
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.62.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.31
Upgrade
Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1030.30
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61
Upgrade
Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1019.19~24.04.3
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.65
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1033.34
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.33
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2050.52
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1056.57
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1018.20~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.64+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71+fips2
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136+fips2
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72+fips1
Configuration
Update the idpf RSS LUT handling so the LUT is available before the interface is brought up and hardware programming is deferred while the interface is down.
Linux kernel idpf driver RSS LUT initialization and programming = Initialize the RSS LUT during vport creation, maintain changes in the driver's software copy, program zeros to the indirection table when rxhash is disabled, and defer hardware programming until the interface is up

Event History

Jan 23, 2026

CVE Published

via OSV·04:15 PM

Data Sourced

via OSV·04:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this crash condition?

Systems using the idpf driver are exposed when an idpf interface has been created but has not yet been brought up for the first time. The affected Ubuntu kernel package variants listed are linux-gcp, linux-riscv, linux-realtime, linux-azure, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.

What is required to trigger the issue?

An attacker or local user needs high privileges and the ability to perform ethtool RSS configuration on an idpf interface before it is first brought up. Disabling rxhash with ethtool in that state can dereference an uninitialized RSS lookup table and crash the kernel.

Are interfaces affected while they are down?

Yes. The vulnerable condition specifically occurs before the interface has been brought up for the first time, because the RSS LUT is not initialized until interface activation. The fix makes the LUT available at virtual-port creation and defers hardware programming while an interface remains down.

What can be done if the kernel cannot be updated immediately?

Avoid changing rxhash or RSS indirection-table settings with ethtool on idpf interfaces before they have been brought up at least once. Restrict access to privileged network administration operations for users who do not need them.

UBUNTU-CVE-2026-22985: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this crash condition?

What is required to trigger the issue?

Are interfaces affected while they are down?

What can be done if the kernel cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this crash condition?

What is required to trigger the issue?

Are interfaces affected while they are down?

What can be done if the kernel cannot be updated immediately?