{"id":"CVE-2026-23054","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hv_netvsc: reject RSS hash key programming without RX indirection table\n\nRSS configuration requires a valid RX indirection table","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hv_netvsc: reject RSS hash key programming without RX indirection table\n\nRSS configuration requires a valid RX indirection table. When the device\nreports a single …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9 < 8288136f508e78eb3563e7073975999cf225a2f9","Linux >= 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9 < 82c9039c8ebb715753a40434df714f865a3aec9c","Linux >= 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9 < 4cd55c609e85ae2313248ef1a33619a3eef44a16","Linux >= 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9 < 11dd9a9ef4dc4507a15a69b8511a0013c6c28fa3","Linux >= 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9 < d23564955811da493f34412d7de60fa268c8cb50","Linux 4.11"],"published":"2026-02-04","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:18:40.580","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23054","references":[{"url":"https://git.kernel.org/stable/c/11dd9a9ef4dc4507a15a69b8511a0013c6c28fa3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cd55c609e85ae2313248ef1a33619a3eef44a16","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8288136f508e78eb3563e7073975999cf225a2f9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82c9039c8ebb715753a40434df714f865a3aec9c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d23564955811da493f34412d7de60fa268c8cb50","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00203,"epssPercentile":0.10152,"ingestedAt":"2026-09-08T15:33:26.994Z","slug":"CVE-2026-23054","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hv_netvsc: reject RSS hash key programming without RX indirection table\n\nRSS configuration requires a valid RX indirection table. When the device\nreports a single receive queue, rndis_filter_device_add() does not\nallocate an indirection table, accepting RSS hash key updates in this\nstate leads to a hang.\n\nFix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return\n-EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device\ncapabilities and prevents incorrect behavior.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}