---
id: CVE-2026-22985
title: 'idpf: Fix RSS LUT NULL pointer crash on early ethtool operations'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  idpf: Fix RSS LUT NULL pointer crash on early ethtool operations

  The RSS LUT is not initialized until the interface comes up, causing
  the following NULL pointer crash …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a251eee62133774cf35ff829041377e721ef9c8c <
    df2790b5228fbd3ed415b70a231cffdad0431618
  - >-
    Linux >= a251eee62133774cf35ff829041377e721ef9c8c <
    b29a5a7dd1f4293ee49c469938c25bf85a5aa802
  - >-
    Linux >= a251eee62133774cf35ff829041377e721ef9c8c <
    83f38f210b85676f40ba8586b5a8edae19b56995
  - Linux 6.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:17:48.587823Z'
published: '2026-01-23'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:13.843Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22985'
references:
  - url: 'https://git.kernel.org/stable/c/df2790b5228fbd3ed415b70a231cffdad0431618'
  - url: 'https://git.kernel.org/stable/c/b29a5a7dd1f4293ee49c469938c25bf85a5aa802'
  - url: 'https://git.kernel.org/stable/c/83f38f210b85676f40ba8586b5a8edae19b56995'
tags:
  - cve.org
epss: 0.00135
epssPercentile: 0.03011
ingestedAt: '2026-11-05T22:38:32.060Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

idpf: Fix RSS LUT NULL pointer crash on early ethtool operations

The RSS LUT is not initialized until the interface comes up, causing
the following NULL pointer crash when ethtool operations like rxhash on/off
are performed before the interface is brought up for the first time.

Move RSS LUT initialization from ndo_open to vport creation to ensure LUT
is always available. This enables RSS configuration via ethtool before
bringing the interface up. Simplify LUT management by maintaining all
changes in the driver's soft copy and programming zeros to the indirection
table when rxhash is disabled. Defer HW programming until the interface
comes up if it is down during rxhash and LUT configuration changes.

Steps to reproduce:
** Load idpf driver; interfaces will be created
	modprobe idpf
** Before bringing the interfaces up, turn rxhash off
	ethtool -K eth2 rxhash off

[89408.371875] BUG: kernel NULL pointer dereference, address: 0000000000000000
[89408.371908] #PF: supervisor read access in kernel mode
[89408.371924] #PF: error_code(0x0000) - not-present page
[89408.371940] PGD 0 P4D 0
[89408.371953] Oops: Oops: 0000 [#1] SMP NOPTI
<snip>
[89408.372052] RIP: 0010:memcpy_orig+0x16/0x130
[89408.372310] Call Trace:
[89408.372317]  <TASK>
[89408.372326]  ? idpf_set_features+0xfc/0x180 [idpf]
[89408.372363]  __netdev_update_features+0x295/0xde0
[89408.372384]  ethnl_set_features+0x15e/0x460
[89408.372406]  genl_family_rcv_msg_doit+0x11f/0x180
[89408.372429]  genl_rcv_msg+0x1ad/0x2b0
[89408.372446]  ? __pfx_ethnl_set_features+0x10/0x10
[89408.372465]  ? __pfx_genl_rcv_msg+0x10/0x10
[89408.372482]  netlink_rcv_skb+0x58/0x100
[89408.372502]  genl_rcv+0x2c/0x50
[89408.372516]  netlink_unicast+0x289/0x3e0
[89408.372533]  netlink_sendmsg+0x215/0x440
[89408.372551]  __sys_sendto+0x234/0x240
[89408.372571]  __x64_sys_sendto+0x28/0x30
[89408.372585]  x64_sys_call+0x1909/0x1da0
[89408.372604]  do_syscall_64+0x7a/0xfa0
[89408.373140]  ? clear_bhb_loop+0x60/0xb0
[89408.373647]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[89408.378887]  </TASK>
<snip>

## Affected

- `Linux >= a251eee62133774cf35ff829041377e721ef9c8c < df2790b5228fbd3ed415b70a231cffdad0431618`
- `Linux >= a251eee62133774cf35ff829041377e721ef9c8c < b29a5a7dd1f4293ee49c469938c25bf85a5aa802`
- `Linux >= a251eee62133774cf35ff829041377e721ef9c8c < 83f38f210b85676f40ba8586b5a8edae19b56995`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.