CVE-2026-23000: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23000 is a NULL pointer dereference vulnerability in the Linux kernel's net/mlx5e driver that can cause a kernel panic (denial of service) during network profile change operations on Mellanox adapters. It was published on January 25, 2026, and affects Linux kernel versions 5.12 through 6.12.66, 6.13 through 6.18.6, and 6.19-rc1 through 6.19-rc5. The vulnerability has a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in the mlx5e_netdev_change_profile() function. When this function fails to attach a new network profile and also fails to roll back to the old profile, the netdev_priv structure is left in a fully reset (dangling) state with priv->mdev set to NULL. A subsequent attempt to change the profile — such as re-enabling switchdev mode via devlink — triggers a crash in mlx5e_detach_netdev when it attempts to dereference the now-NULL priv->mdev pointer. The fix modifies mlx5e_netdev_change_profile() to validate whether the current priv is valid before attempting to access it, and passes netdev and mdev directly to avoid relying on a potentially invalid priv (Red Hat Bugzilla).

Successful exploitation results in a kernel panic (oops), causing an immediate system crash and denial of service. The vulnerability has no impact on confidentiality or integrity — only availability is affected. An attacker with local, low-privileged access on a system using Mellanox mlx5-based network adapters can trigger the crash by attempting to change the eswitch mode (e.g., enabling switchdev mode) after a prior failed profile change attempt (Red Hat Advisory, Red Hat Bugzilla).

1. Identify target: Confirm the target system runs a vulnerable Linux kernel version (5.12–6.12.66, 6.13–6.18.6, or 6.19-rc1 through rc5) with a Mellanox mlx5-based network adapter and that the attacker has local low-privilege access.
2. Trigger initial profile change failure: Use devlink or equivalent tooling to attempt to enable switchdev mode on the Mellanox adapter under resource-constrained conditions (e.g., memory pressure causing workqueue rescuer thread creation to fail with -EINTR or -ENOMEM), causing mlx5e_netdev_change_profile() to fail both the new profile attachment and the rollback.
3. Confirm dangling state: Observe kernel log messages such as mlx5e_netdev_change_profile: failed to rollback to orig profile confirming the netdev_priv is now in a reset/dangling state.
4. Trigger kernel crash: Issue a second devlink command to enable switchdev mode (e.g., devlink dev eswitch set <pci_addr> mode switchdev), causing mlx5e_detach_netdev to dereference the NULL priv->mdev pointer and crash the kernel with a NULL pointer dereference oops (Red Hat Bugzilla).

• Logs: Kernel log entries containing mlx5e_netdev_change_profile: new profile init failed followed by mlx5e_netdev_change_profile: failed to rollback to orig profile; subsequent BUG: kernel NULL pointer dereference, address: 0000000000000038 oops in mlx5e_detach_netdev.
• Logs: Workqueue errors such as workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR preceding the crash.
• Process: Unusual or repeated devlink process activity (devlink dev eswitch set) targeting Mellanox PCI devices, especially from low-privilege users.
• System: Unexpected kernel panics or system reboots on hosts equipped with Mellanox mlx5-based network adapters (Red Hat Bugzilla).

Patches are available in Linux kernel stable branches via commits 4dadc4077e3f, dad52950b409, and e05b8084a20f. Fixed versions include kernel 6.12.67+, 6.18.7+, and 6.19-rc6+. Until patching is possible, restrict local user access to network device management tools and devlink commands, and limit unprivileged users' ability to change eswitch modes on Mellanox adapters through access controls and SELinux/AppArmor policies. Ubuntu security notices USN-8278-1, USN-8289-1, and USN-8296-1 address this issue for Ubuntu users (Red Hat Advisory, Ubuntu USN-8278-1).