CVE-2026-22993: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22993 is a NULL pointer dereference vulnerability in the Linux kernel's idpf network driver affecting RSS LUT (Receive Side Scaling Look-Up Table) handling after a soft reset. During a soft reset, the RSS LUT is freed but not restored unless the interface is up; if an ethtool command accessing the RSS LUT is issued immediately after the reset, the kernel dereferences a NULL pointer and crashes. The vulnerability affects Linux kernel versions 6.7 through 6.18.5 and release candidates 6.19-rc1 through 6.19-rc4. It was published on January 23, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Bugzilla, Red Hat CVE).

The root cause is classified as CWE-476 (NULL Pointer Dereference). During a soft reset of the idpf driver, the RSS LUT memory is freed but not reallocated or restored when the interface is down. If a local user subsequently runs ethtool -x <iface> to display the RSS LUT, the kernel's idpf_get_rxfh() function attempts to read from the now-NULL pointer, triggering a kernel panic. The call trace shows the crash path: idpf_get_rxfh → rss_prepare.isra.0 → rss_prepare_data → ethnl_default_doit → generic netlink receive path. Exploitation requires local access and low privileges (the ability to run ethtool commands and modify queue counts via ethtool -L). No public proof-of-concept exploit code beyond the reproduction steps documented in the kernel commit exists (Red Hat Bugzilla).

Successful exploitation causes a kernel NULL pointer dereference panic, resulting in a system crash and denial of service. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Affected systems using the idpf driver (typically Intel infrastructure data path function NICs) can be crashed by a local low-privileged user, potentially causing unplanned downtime in server or cloud environments (Red Hat CVE).

1. Gain local access: Obtain a local shell on a system running Linux kernel 6.7–6.18.5 or 6.19-rc1 through 6.19-rc4 with the idpf driver loaded and an affected NIC present.
2. Bring the interface down: Execute ifconfig eth1 down (or equivalent) to ensure the interface is not active.
3. Trigger a soft reset via queue count change: Run ethtool -L eth1 combined 20 (adjusting the combined queue count, e.g., from 27 to 20) to initiate a soft reset, which frees the RSS LUT without restoring it.
4. Access the RSS LUT: Immediately run ethtool -x eth1 to attempt to display the RSS LUT. The kernel's idpf_get_rxfh() function dereferences the now-NULL RSS LUT pointer, triggering a kernel panic and system crash (Red Hat Bugzilla).

• Logs: Kernel log entries containing BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP: 0010:idpf_get_rxfh+0x108/0x150 [idpf] in the call trace; presence of Oops: Oops: 0000 [#1] SMP NOPTI in /var/log/kern.log or dmesg output.
• Logs: Call trace entries referencing rss_prepare.isra.0, rss_prepare_data, ethnl_default_doit, and genl_family_rcv_msg_doit immediately preceding a system crash.
• Process: Unusual or repeated execution of ethtool -x <interface> or ethtool -L <interface> commands by non-root low-privileged users on systems with idpf-managed NICs.

Update the Linux kernel to version 6.18.6 or later, which contains the fix. The patch is available at two upstream commits: ab92fa4dd81beaaed4e93a851f7a37c9b2d9776f and ebecca5b093895da801b3eba1a55b4ec4027d196 on kernel.org. Debian has also addressed this in linux 6.12.85+1 (DSA-6238-1). As a temporary workaround until patching is complete, restrict local user access to ethtool RSS commands (e.g., via sudo policy) and avoid running ethtool -x immediately after interface queue count changes or soft resets on systems using the idpf driver (Red Hat CVE, Red Hat Bugzilla).