CVE-2026-22985: Linux Kernel DOS Vulnerability

CVE-2026-22985 Overview

CVE-2026-22985 is a NULL pointer dereference vulnerability in the Linux kernel's idpf (Infrastructure Data Path Function) network driver. The flaw occurs because the Receive Side Scaling (RSS) Lookup Table (LUT) is not initialized until the network interface is brought up. When an unprivileged local user issues ethtool operations such as toggling rxhash before the interface is activated, the kernel dereferences a NULL pointer in idpf_set_features, triggering a kernel oops. The vulnerability affects Linux kernel versions 6.19-rc1 through 6.19-rc4 and is categorized under [CWE-476] NULL Pointer Dereference.

Critical Impact
A local user with permission to run ethtool commands can crash the kernel, causing a denial of service on systems using the idpf driver with supported Intel network devices.

Affected Products

Linux Kernel 6.19-rc1
Linux Kernel 6.19-rc2
Linux Kernel 6.19-rc3 and 6.19-rc4

Discovery Timeline

2026-01-23 - CVE-2026-22985 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-22985

Vulnerability Analysis

The idpf driver manages RSS configuration through a software copy of the indirection table (LUT) that maps incoming flow hashes to receive queues. The driver originally allocated and initialized the LUT inside the ndo_open callback, which only executes when the interface transitions to the up state. Any code path requiring access to the LUT before that point operates on uninitialized state.

When a user runs ethtool -K eth2 rxhash off against a freshly loaded idpf driver, the kernel invokes idpf_set_features to apply the feature change. That function reaches memcpy_orig with a source address of 0x0000000000000000, dereferences the NULL pointer, and triggers Oops: 0000 [#1] SMP NOPTI. The resulting kernel oops halts the calling task and can leave the network stack in an inconsistent state.

Root Cause

The root cause is improper lifecycle management of the RSS LUT. The LUT allocation was tied to ndo_open rather than to vport creation, leaving a window during which feature-modifying ethtool callbacks could run against a non-existent table. The upstream fix moves LUT initialization to vport creation and defers hardware programming until the interface comes up.

Attack Vector

Exploitation requires local access and the ability to invoke ethtool on an idpf-managed interface. An attacker with CAP_NET_ADMIN or equivalent privileges can reliably crash the kernel by running ethtool feature commands immediately after modprobe idpf and before bringing the interface up. There is no remote attack vector and no information disclosure component. The reproducer published in the kernel commit message consists of loading the driver and disabling rxhash on the freshly created interface, after which the kernel produces a NULL pointer dereference oops in memcpy_orig called from idpf_set_features.

Detection Methods for CVE-2026-22985

Indicators of Compromise

Kernel log entries containing BUG: kernel NULL pointer dereference, address: 0000000000000000 with a call trace referencing idpf_set_features and memcpy_orig.
Unexpected interface resets or idpf driver reload events recorded in dmesg or journalctl -k.
Repeated ethtool -K <iface> rxhash off|on invocations on interfaces that have not yet been brought up.

Detection Strategies

Monitor kernel ring buffer output for oops signatures originating from the idpf module and correlate with the running kernel version.
Audit shell history and process telemetry for ethtool feature-change commands executed shortly after modprobe idpf or system boot.
Track unprivileged-to-privileged escalations that grant CAP_NET_ADMIN to non-administrative users on systems hosting Intel IPU-class hardware using idpf.

Monitoring Recommendations

Forward kernel logs to a central data lake and alert on idpf oops patterns alongside system reboots.
Maintain an inventory of hosts running Linux 6.19 release candidate kernels and flag them for upgrade.
Baseline normal ethtool usage per host and alert on out-of-band feature toggles, especially on freshly loaded interfaces.

How to Mitigate CVE-2026-22985

Immediate Actions Required

Upgrade affected hosts to a Linux kernel build that includes the upstream idpf LUT initialization fix.
Restrict CAP_NET_ADMIN and ethtool execution to trusted administrators on systems running the idpf driver.
Bring idpf-managed interfaces up as part of the boot sequence before any feature configuration is performed.

Patch Information

The upstream fix moves RSS LUT initialization from ndo_open to vport creation, keeps all LUT changes in the driver's soft copy, programs zeros to the indirection table when rxhash is disabled, and defers hardware programming until the interface is up. The corresponding commits are available at Kernel Git Commit 83f38f2, Kernel Git Commit b29a5a7, and Kernel Git Commit df2790b. Apply distribution kernel updates once they incorporate these commits.

Workarounds

Bring the interface up with ip link set <iface> up immediately after modprobe idpf and before issuing any ethtool feature commands.
Avoid toggling rxhash and other RSS-related features through ethtool -K until the interface is fully initialized.
Blacklist the idpf module on hosts that do not require Intel IPU connectivity until a patched kernel is deployed.

bash

# Configuration example: safe ordering for idpf interface initialization
modprobe idpf
ip link set eth2 up
ethtool -K eth2 rxhash off