CVE-2026-23042: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23042 is a NULL pointer dereference vulnerability in the Linux kernel's idpf (Intel Infrastructure Data Path Function) network driver. The flaw exists in the idpf_idc_vport_dev_down() function, which unconditionally references vdev_info for every vport, even when RDMA is not supported and vdev_info was never allocated. It was published on February 4, 2026, and affects Linux kernel versions in the range be91128c579c up to 0ad6d6e50e9d (stable branch) and be91128c579c up to 4648fb2f2e72 (another stable branch), with patches available in Linux 6.18.6 and 6.19-rc5. The CVSS category is estimated as Medium, with an EPSS score of 0.00024 (Feedly, EUVD).

The root cause is a missing null check (CWE-476: NULL Pointer Dereference) in the idpf_idc_vport_dev_down() function within the Linux kernel's idpf driver. When a vport does not have the VIRTCHNL2_VPORT_ENABLE_RDMA flag set, the driver skips allocating vdev_info for that vport. However, idpf_idc_vport_dev_down() attempts to dereference vdev_info for all vports without first verifying it was allocated, triggering a kernel NULL pointer dereference. The fix adds a guard check to verify whether vdev_info was allocated before attempting to unplug the auxiliary device (Feedly, kernel.org patch 1, kernel.org patch 2).

Successful exploitation of this vulnerability causes a kernel NULL pointer dereference, which typically results in a kernel panic (system crash), leading to a denial of service (DoS) condition on the affected host. The vulnerability is local in nature and affects systems running the idpf driver with vports that do not support RDMA. There is no evidence of confidentiality or integrity impact; the primary risk is availability loss due to system crash (Feedly, EUVD).

There is no public exploit code or evidence of in-the-wild exploitation for CVE-2026-23042. The EPSS score is 0.00024 (approximately 0.024%), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (plugin IDs 297914 and 304219) and Qualys (plugin ID 761861) (Feedly, Tenable).

The Linux kernel maintainers have released patches addressing this vulnerability. Users should update to Linux kernel version 6.18.6 or later (stable), or 6.19-rc5 or later (mainline). The specific commits resolving the issue are 0ad6d6e50e9d8bf596cfe77a882ddc20b29f525a and 4648fb2f2e7210c53b85220ee07d42d1e4bae3f9. As a temporary workaround, systems not requiring the idpf driver can unload or blacklist the module to eliminate exposure (kernel.org patch 1, kernel.org patch 2).