CVE-2026-22996: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22996 is a NULL pointer dereference vulnerability in the Linux kernel's net/mlx5e driver, specifically in the handling of mlx5e_priv stored in the mlx5e_dev devlink private data structure. When a profile attachment fails (e.g., during an eswitch mode change to switchdev), mlx5e_priv can be zeroed via memset(0), leaving a dangling reference that causes a kernel oops during subsequent devlink dev reload operations. The vulnerability affects Linux kernel versions 5.12 through 6.12.66 and 6.13 through 6.18.6, as well as release candidates 6.19-rc1 through 6.19-rc5. It was published on January 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). The mlx5e_priv pointer stored in the mlx5e_dev devlink private data is used to reference the associated netdev and mdev structures. If profile initialization fails during an eswitch mode change, mlx5e_priv is zeroed out via memset, but the stale pointer in mlx5e_dev is not updated. A subsequent devlink dev reload operation then dereferences this null pointer in mlx5e_remove, triggering a kernel panic at address 0x0000000000000520. The fix replaces the mlx5e_priv reference in mlx5e_dev with a direct netdev pointer and derives mdev from the containing mlx5_adev auxiliary device structure, eliminating the unstable reference (Red Hat Bugzilla, Feedly).

Successful exploitation results in a kernel panic (system crash), causing a complete denial of service on the affected host. An attacker with local access and low privileges can crash the system by first attempting to switch the eswitch mode to switchdev (which fails) and then issuing a devlink dev reload command. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue affecting systems equipped with Mellanox/NVIDIA mlx5 Ethernet adapters running vulnerable kernel versions (Red Hat Advisory, Red Hat Bugzilla).

1. Identify a vulnerable target: Confirm the target system is running Linux kernel versions 5.12–6.12.66 or 6.13–6.18.6 with an mlx5-based Mellanox/NVIDIA Ethernet adapter present and the mlx5e driver loaded.
2. Trigger profile change failure: As a low-privileged local user with access to devlink, execute devlink dev eswitch set pci/<BDF> mode switchdev. This command will fail if the system cannot allocate resources (e.g., due to memory pressure or workqueue creation failure), causing mlx5e_priv_init to fail and mlx5e_priv to be zeroed via memset.
3. Trigger the NULL pointer dereference: Execute devlink dev reload pci/<BDF>. This invokes mlx5e_remove, which dereferences the now-null mlx5e_priv pointer stored in the mlx5e_dev devlink private data, causing a kernel oops at address 0x0000000000000520.
4. Result: The system crashes with a kernel NULL pointer dereference panic, achieving denial of service (Red Hat Bugzilla).

• Logs: Kernel dmesg messages containing workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR; messages from mlx5e_netdev_init_profile reporting mlx5e_priv_init failed, err=-12; messages from mlx5e_netdev_change_profile reporting new profile init failed or failed to rollback to orig profile.
• Logs: Kernel oops message: BUG: kernel NULL pointer dereference, address: 0000000000000520 with call trace including mlx5e_remove, mlx5_detach_device, mlx5_unload_one_devl_locked, mlx5_devlink_reload_down, and devlink_reload.
• Process: Unusual invocation of devlink dev eswitch set followed by devlink dev reload commands by a non-root user on a system with mlx5 hardware (Red Hat Bugzilla).

Patches are available in Linux kernel versions 6.12.67+ (for kernels 5.12–6.12.x) and 6.18.7+ (for kernels 6.13–6.18.x), with fixes also included in all versions beyond 6.19-rc5. Patch commits are available at git.kernel.org: 123eda2e5b1638e298e3a66bb1e64a8da92de5e1, a3d4f87d41f5140f1cf5c02fce5cdad2637f6244, and dcb2ad755a16cb0ecd2dc98234d71a6e216ae7fe. As a temporary workaround for systems that cannot be immediately patched, avoid executing devlink dev eswitch set mode changes or devlink dev reload operations, or disable the mlx5e driver if mlx5 Ethernet adapters are not required. Ubuntu security notices USN-8278-1, USN-8289-1, and USN-8296-1 also address this vulnerability for Ubuntu users (Feedly, Red Hat Bugzilla).