CVE-2026-23000 Overview
A null pointer dereference vulnerability has been identified in the Linux kernel's Mellanox mlx5e network driver. The vulnerability occurs in the mlx5e_netdev_change_profile function when a profile change fails and the subsequent rollback also fails, leaving the system with a dangling network device containing a fully reset netdev_priv structure. A subsequent attempt to change the profile, such as through switchdev mode modification, will crash the kernel when trying to access the now NULL priv->mdev pointer.
Critical Impact
This vulnerability can cause kernel crashes and system instability on systems using Mellanox ConnectX network adapters when switchdev mode changes fail, potentially leading to denial of service conditions in data center and cloud environments.
Affected Products
- Linux kernel with mlx5e (Mellanox ConnectX Ethernet) driver
- Systems utilizing Mellanox mlx5_core networking hardware
- Environments leveraging switchdev mode for network device virtualization
Discovery Timeline
- January 25, 2026 - CVE CVE-2026-23000 published to NVD
- January 26, 2026 - Last updated in NVD database
Technical Details for CVE-2026-23000
Vulnerability Analysis
The vulnerability resides in the Linux kernel's mlx5e network driver, specifically within the profile change mechanism. When mlx5e_netdev_change_profile() attempts to attach a new profile and fails, it tries to rollback to the old profile. If this rollback also fails, the netdev_priv structure becomes fully reset, resulting in a dangling network device with NULL internal pointers.
The problematic code path occurs during switchdev mode transitions. The kernel oops trace shows the crash occurs in mlx5e_detach_netdev() when accessing memory at offset 0x38 of a NULL pointer (the priv->mdev field). The call chain involves mlx5e_netdev_change_profile → mlx5e_vport_rep_load → mlx5_esw_offloads_rep_load → esw_offloads_enable, indicating this is triggered during E-Switch offload operations.
The kernel log messages explicitly show the failure sequence: the initial profile initialization fails with error -12 (ENOMEM - out of memory), followed by a failed rollback attempt, also returning -12. When a second attempt is made to enable switchdev mode, the kernel dereferences the NULL mdev pointer.
Root Cause
The root cause is that mlx5e_netdev_change_profile() assumes the priv structure is always valid. When both the new profile attachment and old profile rollback fail consecutively, the function leaves the network device in an inconsistent state where priv->mdev is NULL. The code lacks defensive checks to handle this edge case where previous failures have left the priv structure in an invalid state.
Attack Vector
This vulnerability is triggered through local system operations involving network device configuration changes. An attacker with sufficient privileges to modify network device settings could potentially exploit this by:
- Inducing memory pressure conditions that cause mlx5e_priv_init to fail with ENOMEM
- Triggering workqueue creation failures (as shown in the logs: "Failed to create a rescuer kthread")
- Repeatedly attempting switchdev mode changes after the initial failure
The attack requires local access and elevated privileges to modify network device configurations. While primarily a denial of service vector, the null pointer dereference could potentially be leveraged for more severe attacks depending on the kernel configuration and memory layout.
Detection Methods for CVE-2026-23000
Indicators of Compromise
- Kernel panic or oops messages containing mlx5e_detach_netdev in the call trace
- Error messages: "mlx5e_netdev_change_profile: failed to rollback to orig profile"
- Workqueue errors: "Failed to create a rescuer kthread for wq 'mlx5e'"
- NULL pointer dereference at address 0x0000000000000038 with RIP pointing to mlx5e_detach_netdev
Detection Strategies
- Monitor kernel logs for mlx5e driver profile change failures and rollback errors
- Implement alerting on kernel NULL pointer dereference crashes in network driver code paths
- Track devlink eswitch mode change operations and their success/failure rates
- Watch for repeated switchdev mode enable attempts following initial failures
Monitoring Recommendations
- Deploy kernel crash dump analysis to identify mlx5e-related null pointer dereferences
- Monitor system memory pressure as low memory conditions can trigger the vulnerability
- Alert on mlx5_devlink_eswitch_mode_set operations that fail consecutively
- Track mlx5_core driver error messages in syslog for profile initialization failures
How to Mitigate CVE-2026-23000
Immediate Actions Required
- Apply the kernel patches from the stable kernel git repository
- Avoid making switchdev mode changes during periods of high memory pressure
- Monitor systems with Mellanox ConnectX adapters for crash symptoms
- Consider temporarily disabling automatic network configuration scripts that may trigger profile changes
Patch Information
The Linux kernel maintainers have released patches to address this vulnerability. The fix modifies mlx5e_netdev_change_profile() to handle previous failures gracefully by not assuming priv is always valid. The updated code passes netdev and mdev directly to functions requiring profile changes, rather than relying on priv. Before attempting to access the old profile, the function now checks if the current priv is valid.
The patches are available from the kernel git repository:
Workarounds
- Ensure adequate system memory is available before performing switchdev mode changes
- Implement retry logic with delays after profile change failures to allow system recovery
- Consider temporarily using legacy eswitch mode instead of switchdev mode on affected systems
- Monitor workqueue creation failures and address underlying resource constraints before retrying operations
# Check current eswitch mode before making changes
devlink dev eswitch show pci/0000:03:00.0
# Ensure sufficient memory before mode change
free -m
echo 3 > /proc/sys/vm/drop_caches
# Monitor kernel logs during mode changes
dmesg -w | grep -E "(mlx5|eswitch|switchdev)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
