CVE-2026-23054: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23054 is a denial-of-service vulnerability in the Linux kernel's hv_netvsc (Hyper-V network virtual service consumer) driver. The flaw arises when RSS (Receive Side Scaling) hash key updates are accepted without a valid RX indirection table being allocated, causing the system to hang. It affects Linux kernel versions from commit 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9 up to the patched releases (6.6.122, 6.12.67, 6.18.7, and 6.19-rc6). The vulnerability was published on February 4, 2026, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.018% (Feedly, EUVD).

The root cause is improper state validation (related to CWE-476, null/missing resource dereference) in the netvsc_set_rxfh() function within the Linux kernel's net/hyperv/hv_netvsc driver. When a Hyper-V virtual NIC reports only a single receive queue, rndis_filter_device_add() does not allocate an RX indirection table (ndc->rx_table_sz remains zero). If a privileged local user or management interface subsequently programs an RSS hash key via ethtool or a similar interface, netvsc_set_rxfh() proceeds without checking for the absent table, leading to a system hang. The fix gates netvsc_set_rxfh() on ndc->rx_table_sz and returns -EOPNOTSUPP when the table is absent (Feedly, Linux Kernel Patches).

Successful exploitation causes the affected Linux system (typically a Hyper-V guest VM) to hang, resulting in a denial of service and loss of availability. There is no evidence of confidentiality or integrity impact, as the vulnerability does not enable code execution or data exfiltration. The scope is limited to systems running Linux as a Hyper-V guest with a single-queue virtual NIC configuration (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-23054. The vulnerability requires local access or the ability to configure network settings on the affected VM (e.g., via ethtool), limiting its attack surface. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Apply the upstream Linux kernel patches that gate netvsc_set_rxfh() on ndc->rx_table_sz. Fixed versions include Linux 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6. Downstream distributions including SUSE (SUSE-2026-0962-1, SUSE-2026-1041-1, SUSE-2026-1131-1), Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1, USN-8278-2, USN-8296-2, USN-8289-2, USN-8393-1), and Oracle Enterprise Linux have released updated kernel packages. As a workaround, avoid programming RSS hash keys on Hyper-V VMs with single-queue NICs until the patch is applied (Feedly, Ubuntu Advisory, openSUSE Advisory).