---
id: CVE-2026-23206
title: 'dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero

  The driver allocates arrays for ports, FDBs, and filter blocks using
  kcalloc() with ethsw->sw_attr…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe <
    2fcccca88456b592bd668db13aa1d29ed257ca2b
  - >-
    Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe <
    80165ff16051448d6f840585ebe13f2400415df3
  - >-
    Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe <
    b97415c4362f739e25ec6f71012277086fabdf6f
  - >-
    Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe <
    4acc40db06ffd0fd92683505342b00c8a7394c60
  - >-
    Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe <
    155eb99aff2920153bf21217ae29565fff81e6af
  - >-
    Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe <
    ed48a84a72fefb20a82dd90a7caa7807e90c6f66
  - Linux 5.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:22:17.004971Z'
published: '2026-02-14'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:21.989Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23206'
references:
  - url: 'https://git.kernel.org/stable/c/2fcccca88456b592bd668db13aa1d29ed257ca2b'
  - url: 'https://git.kernel.org/stable/c/80165ff16051448d6f840585ebe13f2400415df3'
  - url: 'https://git.kernel.org/stable/c/b97415c4362f739e25ec6f71012277086fabdf6f'
  - url: 'https://git.kernel.org/stable/c/4acc40db06ffd0fd92683505342b00c8a7394c60'
  - url: 'https://git.kernel.org/stable/c/155eb99aff2920153bf21217ae29565fff81e6af'
  - url: 'https://git.kernel.org/stable/c/ed48a84a72fefb20a82dd90a7caa7807e90c6f66'
tags:
  - cve.org
epss: 0.00134
epssPercentile: 0.02913
ingestedAt: '2026-11-05T22:38:32.085Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero

The driver allocates arrays for ports, FDBs, and filter blocks using
kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the
device reports zero interfaces (either due to hardware configuration
or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10)
instead of NULL.

Later in dpaa2_switch_probe(), the NAPI initialization unconditionally
accesses ethsw->ports[0]->netdev, which attempts to dereference
ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic.

Add a check to ensure num_ifs is greater than zero after retrieving
device attributes. This prevents the zero-sized allocations and
subsequent invalid pointer dereference.

## Affected

- `Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe < 2fcccca88456b592bd668db13aa1d29ed257ca2b`
- `Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe < 80165ff16051448d6f840585ebe13f2400415df3`
- `Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe < b97415c4362f739e25ec6f71012277086fabdf6f`
- `Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe < 4acc40db06ffd0fd92683505342b00c8a7394c60`
- `Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe < 155eb99aff2920153bf21217ae29565fff81e6af`
- `Linux >= 0b1b71370458860579831e77485883fcf2e8fbbe < ed48a84a72fefb20a82dd90a7caa7807e90c6f66`
- `Linux 5.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.