CVE-2026-43094: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43094 Overview

CVE-2026-43094 is a NULL pointer dereference vulnerability in the Linux kernel ixgbevf driver. The flaw affects Intel 82599 Virtual Function network adapters running on Hyper-V virtual machines. Commit a7075f501bd3 introduced the .negotiate_features callback in ixgbe_mac_operations and populated it in ixgbevf_mac_ops, but failed to add it to ixgbevf_hv_mac_ops. During driver probe on Hyper-V guests, ixgbevf_negotiate_api() invokes ixgbevf_set_features(), which unconditionally dereferences hw->mac.ops.negotiate_features(). The NULL function pointer triggers a kernel oops, preventing the driver from loading and disrupting network connectivity on affected virtual machines.

Critical Impact
Linux guests on Hyper-V using the ixgbevf driver experience a kernel NULL pointer dereference at probe time, causing driver load failure and loss of virtual network functionality.

Affected Products

Linux kernel versions containing commit a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by negotiating supported features")
ixgbevf driver running on Microsoft Hyper-V virtual machines
Intel 82599 Virtual Function network adapters in paravirtualized configurations

Discovery Timeline

2026-05-06 - CVE-2026-43094 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43094

Vulnerability Analysis

The ixgbevf driver maintains two parallel MAC operations tables: ixgbevf_mac_ops for standard PCI passthrough and ixgbevf_hv_mac_ops for Hyper-V synthetic device paths. When the upstream commit added a new .negotiate_features callback to address mailbox API compatibility, the patch updated only the standard ops table.

The Hyper-V variant retained a NULL function pointer at the negotiate_features slot. During driver initialization, the call chain ixgbevf_probe → ixgbevf_sw_init → ixgbevf_negotiate_api reaches ixgbevf_set_features(), which calls the function pointer without a NULL check. The result is a kernel oops at RIP: 0010:0x0 inside the work_for_cpu_fn workqueue context.

Root Cause

The root cause is an incomplete refactor where a new operations vector entry was added to one ops table but omitted from the parallel Hyper-V ops table. The caller assumes all ops table entries are populated and dereferences the function pointer unconditionally rather than guarding the call with a NULL check or -EOPNOTSUPP fallback.

Attack Vector

This vulnerability is not a remotely exploitable security flaw. It manifests as a reliability defect triggered automatically during driver probe on Hyper-V guests with affected hardware. There is no evidence of malicious exploitation, and the issue produces a denial-of-service condition limited to the network driver path. The fix introduces ixgbevf_hv_negotiate_features_vf() which returns -EOPNOTSUPP and wires it into ixgbevf_hv_mac_ops. The caller already handles -EOPNOTSUPP gracefully.

The vulnerability manifests in the function pointer dispatch logic of the ixgbevf driver. See the kernel commit references for the complete fix.

Detection Methods for CVE-2026-43094

Indicators of Compromise

Kernel oops messages containing BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP: 0010:0x0
Stack traces referencing ixgbevf_negotiate_api, ixgbevf_sw_init, or ixgbevf_probe in dmesg output
Failed ixgbevf driver load on Hyper-V guests with hardware string Microsoft Corporation Virtual Machine

Detection Strategies

Monitor /var/log/messages and journalctl -k for ixgbevf probe failures and NULL dereference crashes
Inventory Linux VMs running on Hyper-V hosts and verify kernel versions against fixed stable branches
Use configuration management tools to flag systems running pre-patch kernels with the ixgbevf module loaded

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on NULL pointer dereference events tied to network drivers
Track network interface availability on Hyper-V guests to detect driver load failures that result in missing interfaces
Correlate kernel crash telemetry with kernel package versions to identify unpatched fleets

How to Mitigate CVE-2026-43094

Immediate Actions Required

Apply the upstream stable kernel update that includes the fix introducing ixgbevf_hv_negotiate_features_vf()
Reboot affected Hyper-V guests after kernel installation to load the corrected ixgbevf module
Validate that affected VMs successfully bring up ixgbevf interfaces post-update

Patch Information

The fix is available across multiple stable kernel branches. Refer to the upstream commits: Kernel Git Commit 1455ff8, Kernel Git Commit 2270eba, Kernel Git Commit 4821d56, Kernel Git Commit 4db7b61, and Kernel Git Commit d8a7470.

Workarounds

Blacklist the ixgbevf module on affected Hyper-V guests if patching is not immediately feasible and an alternative network interface is available
Switch impacted VMs to the Hyper-V synthetic network adapter (hv_netvsc) instead of SR-IOV passthrough until the kernel is updated
Pin affected workloads to hosts where SR-IOV with ixgbevf is not assigned to the guest

bash

# Configuration example - blacklist ixgbevf until kernel is patched
echo "blacklist ixgbevf" | sudo tee /etc/modprobe.d/blacklist-ixgbevf.conf
sudo update-initramfs -u
sudo reboot