CVE-2026-23035: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23035 is a NULL pointer dereference vulnerability in the Linux kernel's net/mlx5e network driver affecting systems with Mellanox ConnectX (mlx5) network adapters. The flaw occurs when mlx5e_destroy_netdev() is called with an unstable mlx5e_priv structure that has been zeroed out following a failed eswitch profile attachment, leading to a kernel oops (crash) upon a subsequent devlink reload operation. It was published on January 31, 2026, with a patch tracked via Red Hat Bugzilla. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat Bugzilla, Red Hat CVE).

The root cause is a NULL pointer dereference (CWE-476) in the mlx5e_remove() function of the Linux kernel's mlx5e driver. When a user attempts to switch a Mellanox device to switchdev (eswitch offloads) mode via devlink dev eswitch set and the profile attachment fails, the mlx5e_priv structure is memset(0), rendering it invalid. A subsequent devlink dev reload triggers mlx5e_remove(), which attempts to use the now-invalid priv pointer for resource cleanup — specifically crashing in mlx5e_dcbnl_dscp_app at address 0x0000000000000370. The fix involves passing netdev (which remains valid) to mlx5e_destroy_netdev() instead of priv, and adding a validity check for priv->profile before any cleanup is attempted (Red Hat Bugzilla).

Successful exploitation causes a kernel NULL pointer dereference, crashing the affected Linux system (denial of service). The crash occurs in the context of a local user with low privileges issuing devlink commands, meaning availability is fully compromised for the duration of the crash/reboot cycle. There is no evidence of confidentiality or integrity impact beyond the kernel oops itself; however, a kernel crash in production environments with Mellanox mlx5 adapters (e.g., high-performance networking or GPU-attached systems) can result in significant service disruption (Red Hat Bugzilla, Red Hat CVE).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges and high attack complexity (the attacker must first trigger a failed eswitch mode switch before issuing a reload). The EPSS score is approximately 0.017% (0.000170), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE).

1. Precondition: Obtain local access to a Linux system with a Mellanox ConnectX (mlx5) network adapter and low-privilege access sufficient to run devlink commands.
2. Trigger failed eswitch mode switch: Execute devlink dev eswitch set pci/<BDF> mode switchdev on the target device. If the system is resource-constrained (e.g., low memory causing -ENOMEM/-EINTR), the profile attachment will fail, leaving mlx5e_priv in a zeroed/invalid state.
3. Observe failure: Confirm the failure via dmesg, which will show messages such as mlx5e_priv_init failed, err=-12 and mlx5e_netdev_change_profile: failed to rollback to orig profile.
4. Trigger kernel crash: Execute devlink dev reload pci/<BDF>, which calls mlx5e_remove() using the now-invalid priv pointer, resulting in a NULL pointer dereference at mlx5e_dcbnl_dscp_app and a kernel oops/panic (Red Hat Bugzilla).

• Logs (dmesg/kernel log):
  • workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR
  • mlx5e_netdev_init_profile: mlx5e_priv_init failed, err=-12
  • mlx5e_netdev_change_profile: new profile init failed or failed to rollback to orig profile
  • BUG: kernel NULL pointer dereference, address: 0000000000000370
  • RIP: 0010:mlx5e_dcbnl_dscp_app+0x23/0x100 in kernel oops output
  • Call trace including mlx5e_remove, mlx5_detach_device, mlx5_devlink_reload_down, devlink_reload
• Process Activity:
  • devlink process (PID visible in oops) issuing reload commands against an mlx5 PCI device shortly after a failed eswitch mode change
• System Behavior:
  • Unexpected kernel panic or system reboot following devlink dev reload on a Mellanox mlx5 device (Red Hat Bugzilla)

Apply the upstream kernel patch that modifies mlx5e_destroy_netdev() to accept netdev instead of mlx5e_priv, and adds a priv->profile validity check in mlx5e_remove(). Patches are available in stable kernel trees (commits 4ef8512e, 66a25f6b, a7625bac). Vendor updates have been issued by Red Hat, SUSE (SUSE-2026-0962-1), Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1, USN-8278-2, USN-8289-2, USN-8296-2), and Oracle. As a workaround until patching, avoid switching Mellanox ConnectX devices between eswitch modes in production; if a switchdev mode change fails, reboot the system rather than issuing a devlink reload command (Red Hat Bugzilla, Red Hat CVE).