CVE-2026-22993: Linux Kernel Use-After-Free Vulnerability

CVE-2026-22993 Overview

CVE-2026-22993 is a NULL pointer dereference vulnerability in the Linux kernel's idpf (Intel Infrastructure Data Path Function) network driver. The flaw exists in the Receive Side Scaling (RSS) Lookup Table (LUT) handling logic after a soft reset operation. During a soft reset, the driver frees the RSS LUT and does not restore it unless the interface is brought up. A local user invoking an ethtool command that accesses the RSS LUT immediately after the reset triggers a kernel NULL pointer dereference in idpf_get_rxfh, resulting in a kernel oops and denial of service. The issue is tracked under [CWE-476] and affects Linux kernel 6.19 release candidates.

Critical Impact
A local user with sufficient privileges to invoke ethtool against an idpf-managed interface can trigger a kernel NULL pointer dereference, causing a denial of service on the affected host.

Affected Products

Linux Kernel 6.19-rc1
Linux Kernel 6.19-rc2 through 6.19-rc4
Systems using the Intel idpf network driver

Discovery Timeline

2026-01-23 - CVE-2026-22993 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-22993

Vulnerability Analysis

The vulnerability resides in the idpf driver's handling of the RSS LUT during soft reset operations. RSS distributes incoming network traffic across multiple receive queues, and the LUT maps hash values to those queues. During a soft reset triggered by operations such as queue count changes, the driver frees the RSS LUT memory. The LUT is only reallocated and restored when the interface transitions to an up state.

If a user executes an ethtool command such as ethtool -x eth1 to display the RSS configuration while the interface remains down after the reset, the idpf_get_rxfh function attempts to read from the freed LUT pointer. This results in a kernel NULL pointer dereference at address 0x0000000000000000, producing the BUG: kernel NULL pointer dereference oops shown in the upstream report.

The call path traverses rss_prepare, rss_prepare_data, ethnl_default_doit, and the generic netlink message handler before reaching idpf_get_rxfh+0x108/0x150.

Root Cause

The driver did not validate the RSS LUT pointer before access in idpf_get_rxfh, and the soft reset code path unconditionally freed the LUT without ensuring a valid state for subsequent ethtool queries. Additionally, the reset logic destroyed the LUT even when the queue count did not change, creating an unnecessary window of invalid state.

Attack Vector

Exploitation requires local access and the ability to invoke ethtool operations against the affected interface. An attacker reproduces the condition by bringing the interface down with ifconfig eth1 down, modifying the queue count using ethtool -L eth1 combined <count>, and then querying the RSS table with ethtool -x eth1. The resulting kernel oops disrupts kernel execution and can render the system unstable.

The vulnerability does not impact confidentiality or integrity. The impact is limited to availability through a kernel crash on the host.

Detection Methods for CVE-2026-22993

Indicators of Compromise

Kernel log entries containing BUG: kernel NULL pointer dereference, address: 0000000000000000 referencing idpf_get_rxfh
Kernel oops traces that include rss_prepare, rss_prepare_data, and ethnl_default_doit frames
Unexpected interface resets or driver reinitialization events on hosts using the idpf driver

Detection Strategies

Inventory hosts running Linux kernel 6.19-rc1 through 6.19-rc4 with the idpf driver loaded by inspecting lsmod and uname -r output
Monitor dmesg and journalctl -k for NULL pointer dereference oops messages referencing idpf symbols
Audit user and process activity for ethtool -x or ethtool -L commands targeting idpf-managed interfaces

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized logging platform and alert on Oops: and idpf_get_rxfh patterns
Track ethtool invocations through auditd rules on /sbin/ethtool execution events
Correlate interface state transitions (ifconfig or ip link) with subsequent ethtool queries to identify reproduction patterns

How to Mitigate CVE-2026-22993

Immediate Actions Required

Apply the upstream Linux kernel patches that fix the RSS LUT lifecycle in the idpf driver
Restrict ethtool execution to administrative users only by enforcing strict sudo policies and removing setuid privileges where present
Avoid modifying queue counts on idpf interfaces while the interface is down on unpatched systems

Patch Information

The fix is available in the upstream Linux kernel via commits a09380354d2f, ab92fa4dd81b, and ebecca5b0938. The patch ensures the RSS LUT is reset to defaults only when the soft reset results from a queue count change and the LUT was not configured by the user. In all other cases, the LUT remains untouched, eliminating the NULL pointer dereference window.

Workarounds

Bring the affected interface up before issuing ethtool commands that read the RSS LUT, such as ethtool -x
Defer queue count modifications until administrators can guarantee the interface is brought back up immediately after
Limit local shell access on hosts running affected kernel versions until patches are deployed

bash

# Verify kernel version and idpf driver presence
uname -r
lsmod | grep idpf

# Safe sequence: bring interface up before querying RSS
ip link set eth1 up
ethtool -x eth1