CVE-2026-22985: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22985 is a NULL pointer dereference vulnerability in the Linux kernel's idpf (Intel Data Path Function) network driver, specifically in its RSS (Receive Side Scaling) Look-Up Table (LUT) initialization logic. The flaw affects Linux kernel versions 6.7 through 6.18.5, as well as 6.19-rc1 through 6.19-rc4. It was published on January 23, 2026, and received a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause (CWE-476: NULL Pointer Dereference) lies in the idpf driver's RSS LUT not being initialized until the network interface is brought up via ndo_open. When a local user performs ethtool operations (e.g., ethtool -K eth2 rxhash off) before the interface is first brought up, the driver's idpf_set_features function attempts to access the uninitialized LUT pointer, triggering a kernel NULL pointer dereference at address 0x0000000000000000 inside memcpy_orig. The fix moves RSS LUT initialization from ndo_open to vport creation time, ensuring the LUT is always available, and defers hardware programming until the interface comes up if it is currently down (Red Hat Bugzilla).

Successful exploitation causes a kernel panic (BUG: kernel NULL pointer dereference), resulting in a complete denial of service — the affected system crashes and must be rebooted. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Because exploitation requires only local access with low privileges, it poses a meaningful risk in multi-tenant or shared Linux environments where users can load kernel modules and run ethtool commands (Red Hat Advisory).

1. Prerequisite: Obtain local access to a Linux system running kernel version 6.7–6.18.5 or 6.19-rc1 through 6.19-rc4 with the idpf driver available.
2. Load the idpf driver: Execute modprobe idpf to load the driver and create network interfaces (e.g., eth2). At this point, the RSS LUT is uninitialized.
3. Trigger the vulnerability: Before bringing the interface up, run ethtool -K eth2 rxhash off. This invokes idpf_set_features, which attempts to access the NULL RSS LUT pointer.
4. Kernel panic: The kernel dereferences the NULL pointer inside memcpy_orig (called from idpf_set_features → __netdev_update_features → ethnl_set_features), producing a fatal BUG: kernel NULL pointer dereference oops and crashing the system (Red Hat Bugzilla).

• Logs: Kernel log entries containing BUG: kernel NULL pointer dereference, address: 0000000000000000 and RIP: 0010:memcpy_orig+0x16/0x130 with a call trace including idpf_set_features, __netdev_update_features, and ethnl_set_features.
• Logs: Kernel oops messages referencing #PF: supervisor read access in kernel mode and #PF: error_code(0x0000) - not-present page in /var/log/kern.log or dmesg output.
• Process/Command: Execution of modprobe idpf followed immediately by ethtool -K <interface> rxhash off (or similar feature-toggling commands) before the interface is brought up, visible in shell history or audit logs.

Update the Linux kernel to version 6.18.6 or later (for the 6.7–6.18.x series), or apply a patched 6.19 stable release. Patch commits are available at git.kernel.org (commits 83f38f210b85676f40ba8586b5a8edae19b56995, b29a5a7dd1f4293ee49c469938c25bf85a5aa802, and df2790b5228fbd3ed415b70a231cffdad0431618). Debian has also released a fix in linux 6.12.85-1 (DSA-6238-1). As a temporary workaround, restrict local user access to ethtool commands (e.g., via sudo policies) and avoid running ethtool feature-toggling operations on idpf-managed interfaces before they are brought up (Red Hat Bugzilla, Debian Advisory).

Red Hat tracked the issue via Bugzilla (Bug 2432381) and assigned it medium severity. The Yocto Project security mailing list discussed the vulnerability across multiple messages, indicating awareness in the embedded Linux community. Debian addressed it in DSA-6238-1 (linux 6.12.85-1). No notable researcher commentary or significant social media discussion beyond automated CVE tracking feeds has been observed.