CVE-2026-23173: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23173 is a NULL pointer dereference vulnerability in the Linux kernel's mlx5e traffic control (TC) steering flow deletion function (mlx5e_tc_del_fdb_peers_flow). The flaw arises when the driver iterates over device communication (devcom) peers without verifying their existence, causing a kernel crash when non-existent peers are accessed. Affected kernel versions include 6.5 through 6.6.122, 6.7 through 6.12.68, 6.13 through 6.18.8, and 6.19-rc1 through 6.19-rc7. It was published on February 14, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In the mlx5e_tc_del_fdb_peers_flow function within the mlx5_core kernel driver, the code assumes all possible devcom peer ports exist when deleting TC steering flows, rather than iterating only over actual connected peers. This causes a write access to memory address 0x0000000000000008 (a near-NULL offset), triggering a kernel "Oops" with the error BUG: kernel NULL pointer dereference. The vulnerability is exploitable locally by a low-privileged user who can execute traffic control (tc) commands on network interfaces using mlx5e hardware (Feedly, Kernel Patch).

Successful exploitation results in a kernel panic or denial of service (DoS) condition, crashing the affected process and rendering the system unstable or unresponsive. There is no confidentiality or integrity impact — the vulnerability is limited to availability (kernel crash). Because the crash occurs in kernel mode during TC qdisc operations on mlx5e network interfaces, it can affect any workload running on the host, including virtualized environments using QEMU with mlx5 hardware (Feedly).

1. Gain local access: Obtain a local shell on a system running a vulnerable Linux kernel version (6.5–6.6.122, 6.7–6.12.68, 6.13–6.18.8, or 6.19-rc1 through rc7) with an mlx5e-based network interface (e.g., Mellanox/NVIDIA ConnectX NIC).
2. Identify the target interface: Use ip link or ls /sys/class/net/ to identify network interfaces managed by the mlx5_core driver.
3. Configure TC qdisc: Set up a TC queueing discipline on the target interface, e.g., tc qdisc add dev <iface> root handle 1: prio.
4. Add a TC flow rule: Add a flow rule that involves peer device communication, e.g., using tc filter add with a flower classifier targeting an mlx5e offloaded flow.
5. Delete the TC flow: Execute tc filter del or tc qdisc del to trigger the deletion path in mlx5e_tc_del_fdb_peers_flow, which iterates over non-existent devcom peers and dereferences a NULL pointer, causing a kernel panic (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) containing BUG: kernel NULL pointer dereference, address: 0000000000000008 with a call trace referencing mlx5e_tc_del_fdb_peers_flow.
• Logs: Kernel "Oops" entries with RIP: 0010:mlx5e_tc_del_fdb_peers_flow+0xbe/0x200 [mlx5_core] and associated register dumps.
• Process: Unexpected termination or crash of the tc process (PID associated with traffic control commands) on systems with mlx5e NICs.
• System: Sudden system instability, kernel panic, or reboot on hosts running mlx5_core driver with TC offload enabled (Feedly).

Patches have been released in the following stable kernel versions: 6.6.123, 6.12.69, and 6.18.9 (Kernel Patch, Feedly). Oracle Linux and Ubuntu have also issued updated kernel packages incorporating these fixes. For systems that cannot be immediately patched, restrict local user privileges to prevent execution of tc commands (e.g., via sudo policy or Linux capabilities restrictions), and consider disabling TC hardware offload on mlx5e interfaces if operationally feasible. Monitor kernel logs for crash signatures referencing mlx5e_tc_del_fdb_peers_flow as an indicator of exploitation attempts.