---
id: CVE-2026-22993
title: 'idpf: Fix RSS LUT NULL ptr issue after soft reset'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  idpf: Fix RSS LUT NULL ptr issue after soft reset

  During soft reset, the RSS LUT is freed and not restored unless the
  interface is up. If an ethtool command that acces…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 02cbfba1add5bd9088c7d14c6b93b77a6ea8f3bb <
    a09380354d2f14759b9dd45de1bc2f6bf49e651b
  - >-
    Linux >= 02cbfba1add5bd9088c7d14c6b93b77a6ea8f3bb <
    ab92fa4dd81beaaed4e93a851f7a37c9b2d9776f
  - >-
    Linux >= 02cbfba1add5bd9088c7d14c6b93b77a6ea8f3bb <
    ebecca5b093895da801b3eba1a55b4ec4027d196
  - Linux 6.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:18:00.258491Z'
published: '2026-01-23'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:14.239Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22993'
references:
  - url: 'https://git.kernel.org/stable/c/a09380354d2f14759b9dd45de1bc2f6bf49e651b'
  - url: 'https://git.kernel.org/stable/c/ab92fa4dd81beaaed4e93a851f7a37c9b2d9776f'
  - url: 'https://git.kernel.org/stable/c/ebecca5b093895da801b3eba1a55b4ec4027d196'
tags:
  - cve.org
epss: 0.00135
epssPercentile: 0.03012
ingestedAt: '2026-11-05T22:38:32.064Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

idpf: Fix RSS LUT NULL ptr issue after soft reset

During soft reset, the RSS LUT is freed and not restored unless the
interface is up. If an ethtool command that accesses the rss lut is
attempted immediately after reset, it will result in NULL ptr
dereference. Also, there is no need to reset the rss lut if the soft reset
does not involve queue count change.

After soft reset, set the RSS LUT to default values based on the updated
queue count only if the reset was a result of a queue count change and
the LUT was not configured by the user. In all other cases, don't touch
the LUT.

Steps to reproduce:

** Bring the interface down (if up)
ifconfig eth1 down

** update the queue count (eg., 27->20)
ethtool -L eth1 combined 20

** display the RSS LUT
ethtool -x eth1

[82375.558338] BUG: kernel NULL pointer dereference, address: 0000000000000000
[82375.558373] #PF: supervisor read access in kernel mode
[82375.558391] #PF: error_code(0x0000) - not-present page
[82375.558408] PGD 0 P4D 0
[82375.558421] Oops: Oops: 0000 [#1] SMP NOPTI
<snip>
[82375.558516] RIP: 0010:idpf_get_rxfh+0x108/0x150 [idpf]
[82375.558786] Call Trace:
[82375.558793]  <TASK>
[82375.558804]  rss_prepare.isra.0+0x187/0x2a0
[82375.558827]  rss_prepare_data+0x3a/0x50
[82375.558845]  ethnl_default_doit+0x13d/0x3e0
[82375.558863]  genl_family_rcv_msg_doit+0x11f/0x180
[82375.558886]  genl_rcv_msg+0x1ad/0x2b0
[82375.558902]  ? __pfx_ethnl_default_doit+0x10/0x10
[82375.558920]  ? __pfx_genl_rcv_msg+0x10/0x10
[82375.558937]  netlink_rcv_skb+0x58/0x100
[82375.558957]  genl_rcv+0x2c/0x50
[82375.558971]  netlink_unicast+0x289/0x3e0
[82375.558988]  netlink_sendmsg+0x215/0x440
[82375.559005]  __sys_sendto+0x234/0x240
[82375.559555]  __x64_sys_sendto+0x28/0x30
[82375.560068]  x64_sys_call+0x1909/0x1da0
[82375.560576]  do_syscall_64+0x7a/0xfa0
[82375.561076]  ? clear_bhb_loop+0x60/0xb0
[82375.561567]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
<snip>

## Affected

- `Linux >= 02cbfba1add5bd9088c7d14c6b93b77a6ea8f3bb < a09380354d2f14759b9dd45de1bc2f6bf49e651b`
- `Linux >= 02cbfba1add5bd9088c7d14c6b93b77a6ea8f3bb < ab92fa4dd81beaaed4e93a851f7a37c9b2d9776f`
- `Linux >= 02cbfba1add5bd9088c7d14c6b93b77a6ea8f3bb < ebecca5b093895da801b3eba1a55b4ec4027d196`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.