CVE-2026-23054: Linux Kernel hv_netvsc DOS Vulnerability

CVE-2026-23054 Overview

CVE-2026-23054 is a vulnerability in the Linux kernel's Hyper-V network driver (hv_netvsc) that can cause a system hang when attempting to program RSS (Receive Side Scaling) hash keys without a valid RX indirection table. The vulnerability exists in the netvsc_set_rxfh() function, which failed to properly validate the presence of an indirection table before accepting RSS hash key updates.

When a device reports only a single receive queue, the rndis_filter_device_add() function does not allocate an RX indirection table. Accepting RSS hash key updates in this state leads to undefined behavior resulting in a system hang, causing a denial of service condition.

Critical Impact

Exploitation of this vulnerability can cause affected Linux systems running on Hyper-V to become unresponsive, requiring a hard reboot to recover.

Affected Products

• Linux kernel with hv_netvsc driver enabled
• Systems running Linux on Microsoft Hyper-V
• Azure virtual machines running vulnerable kernel versions

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-23054 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-23054

Vulnerability Analysis

This vulnerability is classified as a Denial of Service (DoS) condition caused by improper validation in the Linux kernel's Hyper-V network virtual service client driver. The hv_netvsc driver implements network connectivity for Linux guests running on Microsoft Hyper-V hypervisor.

RSS (Receive Side Scaling) is a network driver technology that enables efficient distribution of network receive processing across multiple CPUs. The RSS configuration typically includes an indirection table that maps receive queues to CPUs and a hash key used to compute the hash for packet distribution.

The vulnerability occurs when the driver attempts to process RSS hash key programming requests without first verifying that a valid RX indirection table exists. When only a single receive queue is reported by the device, rndis_filter_device_add() skips allocation of the indirection table. Subsequent attempts to update the RSS hash key via netvsc_set_rxfh() then operate on invalid data structures, causing the system to hang.

Root Cause

The root cause is a missing validation check in the netvsc_set_rxfh() function. The function did not verify whether ndc->rx_table_sz was non-zero before attempting RSS hash key operations. When the RX indirection table is absent (table size is zero), the hash key programming proceeds anyway, leading to undefined behavior and ultimately a system hang.

The fix introduces a gate on ndc->rx_table_sz in netvsc_set_rxfh(), returning -EOPNOTSUPP when the indirection table is not allocated. This ensures the RSS configuration interface properly reflects the actual device capabilities.

Attack Vector

An attacker with local access to a vulnerable Linux system running on Hyper-V could trigger this vulnerability by attempting to configure RSS hash keys through the ethtool interface or similar mechanisms. The attack requires the ability to modify network device settings, which typically requires elevated privileges (root or CAP_NET_ADMIN capability).

The attack scenario involves:

1. Identifying a Hyper-V virtual machine running a vulnerable Linux kernel with the hv_netvsc driver
2. Confirming the network device reports only a single receive queue (no indirection table allocated)
3. Attempting to set RSS hash keys via ethtool -X or programmatically through netlink
4. The system becomes unresponsive, requiring administrative intervention to recover

Detection Methods for CVE-2026-23054

Indicators of Compromise

• System hangs or becomes unresponsive after network configuration changes on Hyper-V guests
• Kernel log messages related to hv_netvsc driver operations prior to system freeze
• Attempted RSS configuration changes on single-queue network devices in audit logs
• Unexplained virtual machine restarts in Azure or on-premises Hyper-V environments

Detection Strategies

• Monitor for ethtool commands attempting to modify RSS settings on hv_netvsc interfaces
• Implement audit rules tracking network device configuration changes requiring CAP_NET_ADMIN
• Deploy kernel version detection to identify systems running vulnerable kernel releases
• Use endpoint detection solutions to correlate network configuration changes with system instability

Monitoring Recommendations

• Enable comprehensive logging for network subsystem configuration changes
• Configure alerting for unexpected system reboots or hangs on Hyper-V/Azure Linux VMs
• Implement kernel version inventory tracking across your Linux fleet
• Monitor for privilege escalation attempts that could grant CAP_NET_ADMIN capabilities

How to Mitigate CVE-2026-23054

Immediate Actions Required

• Apply the kernel patches from the official kernel git repository immediately
• Restrict access to network configuration capabilities (CAP_NET_ADMIN) to trusted administrators only
• Review and audit users with elevated network configuration privileges
• Consider temporarily disabling RSS configuration tools on production systems until patched

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix adds proper validation in netvsc_set_rxfh() to check for the presence of a valid RX indirection table before accepting RSS hash key updates. When the table is absent, the function now returns -EOPNOTSUPP, properly indicating the operation is not supported.

The patches are available from the following kernel git commits:

• Kernel Git Commit 11dd9a9e
• Kernel Git Commit 4cd55c60
• Kernel Git Commit 82c9039c
• Kernel Git Commit d2356495

Update your Linux kernel to a version containing one of these patches. Distribution vendors will release updated kernel packages incorporating this fix.

Workarounds

• Restrict access to the ethtool command and network configuration utilities through file permissions or SELinux/AppArmor policies
• Remove CAP_NET_ADMIN capability from non-essential users and processes
• Implement network namespace isolation to limit network configuration scope
• For Azure VMs, consider using Azure-provided managed images with patched kernels

# Restrict ethtool access to root only
chmod 750 /usr/sbin/ethtool
chown root:root /usr/sbin/ethtool

# Audit network configuration changes
auditctl -w /usr/sbin/ethtool -p x -k network_config

# Check current kernel version for vulnerability assessment
uname -r