CVE-2026-23206: Linux Kernel dpaa2-switch DoS Vulnerability

CVE-2026-23206 Overview

A null pointer dereference vulnerability has been identified in the Linux kernel's dpaa2-switch driver. The vulnerability occurs when the driver allocates arrays for ports, FDBs, and filter blocks using kcalloc() with ethsw->sw_attr.num_ifs as the element count. When a device reports zero interfaces—either due to hardware configuration or firmware issues—kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10) instead of NULL. During NAPI initialization in dpaa2_switch_probe(), the code unconditionally accesses ethsw->ports[0]->netdev, which attempts to dereference the ZERO_SIZE_PTR address (0x10), resulting in a kernel panic.

Critical Impact

This vulnerability can cause kernel panic and system crash when the dpaa2-switch driver initializes with zero interfaces reported, leading to denial of service on affected systems.

Affected Products

• Linux kernel (dpaa2-switch driver)
• Systems with NXP DPAA2 Ethernet switch hardware
• Embedded networking devices using the dpaa2-switch driver

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-23206 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23206

Vulnerability Analysis

This vulnerability stems from improper handling of edge cases in the dpaa2-switch driver's initialization routine. The driver relies on device-reported attributes, specifically ethsw->sw_attr.num_ifs, to determine how many network interface structures to allocate. When this value is zero—a condition that can arise from misconfigured hardware or corrupted firmware data—the memory allocation function kcalloc() exhibits unexpected behavior.

In the Linux kernel, kcalloc(0, size, flags) does not return NULL as might be expected for a "zero items" allocation. Instead, it returns a special sentinel value called ZERO_SIZE_PTR, which is defined as ((void *)16) or 0x10. This non-NULL return value passes standard NULL-pointer checks, allowing execution to continue with what appears to be a valid pointer.

The crash occurs during NAPI (New API) initialization when the driver attempts to access ethsw->ports[0]->netdev. Since ethsw->ports points to address 0x10 rather than a valid memory region, dereferencing this pointer triggers a memory access violation and subsequent kernel panic.

Root Cause

The root cause is the absence of validation for the num_ifs device attribute before using it as a memory allocation count. The driver assumes that the hardware or firmware will always report a non-zero number of interfaces, which is not guaranteed. The fix adds an explicit check to ensure num_ifs is greater than zero after retrieving device attributes, preventing both the zero-sized allocation and the subsequent invalid pointer dereference.

Attack Vector

The attack vector for this vulnerability is primarily local, requiring either:

1. Hardware misconfiguration: A system administrator or attacker with physical access could configure the DPAA2 switch hardware to report zero interfaces
2. Firmware manipulation: Corrupting or manipulating the firmware to report incorrect interface counts
3. Driver probing with faulty hardware: Legitimate hardware failures or defects causing zero interface reports

While this vulnerability does not provide direct code execution, it creates a reliable denial-of-service condition. An attacker with local system access could potentially trigger the vulnerable code path during driver initialization or reload, causing immediate system crashes.

The vulnerability manifests during the dpaa2_switch_probe() function when the driver initializes NAPI structures. The code assumes that at least one port exists and unconditionally accesses the first port's network device structure, leading to the ZERO_SIZE_PTR dereference. Technical details are available in the kernel git commits referenced below.

Detection Methods for CVE-2026-23206

Indicators of Compromise

• Kernel panic logs containing references to dpaa2_switch_probe or NAPI initialization routines
• System crash dumps showing attempted memory access at address 0x10 (ZERO_SIZE_PTR)
• Unexpected system reboots on systems with DPAA2 switch hardware
• Kernel oops messages referencing the dpaa2-switch driver module

Detection Strategies

• Monitor kernel logs for panic messages originating from the dpaa2-switch driver
• Implement system health monitoring to detect unexpected reboots or crashes
• Use kernel tracing tools to monitor kcalloc() calls with zero element count
• Deploy crash dump analysis to identify ZERO_SIZE_PTR dereference patterns

Monitoring Recommendations

• Enable kernel crash dump collection using kdump or similar tools
• Configure alerts for dpaa2-switch driver errors in system logs
• Monitor hardware firmware version and configuration for anomalies
• Implement continuous uptime monitoring for systems with DPAA2 hardware

How to Mitigate CVE-2026-23206

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix
• Review systems with DPAA2 switch hardware for potential exposure
• Consider disabling or blacklisting the dpaa2-switch module on systems where it is not required
• Implement hardware and firmware integrity verification on affected systems

Patch Information

The vulnerability has been addressed in multiple kernel stable branches. The fix adds a validation check to ensure num_ifs is greater than zero after retrieving device attributes, preventing zero-sized allocations and subsequent invalid pointer dereferencing. Patches are available through the following kernel git commits:

• Kernel Git Commit 155eb99a
• Kernel Git Commit 2fcccca8
• Kernel Git Commit 4acc40db
• Kernel Git Commit 80165ff1
• Kernel Git Commit b97415c4
• Kernel Git Commit ed48a84a

Workarounds

• Blacklist the dpaa2-switch kernel module on systems where DPAA2 switch functionality is not required
• Verify firmware integrity before loading the dpaa2-switch driver
• Implement boot-time checks to validate hardware interface counts before driver initialization

# Blacklist dpaa2-switch module if not needed
echo "blacklist dpaa2_switch" >> /etc/modprobe.d/dpaa2-blacklist.conf

# Apply kernel updates on Debian/Ubuntu systems
apt update && apt upgrade linux-image-$(uname -r)

# Apply kernel updates on RHEL/CentOS systems
yum update kernel