Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux Kernel: Prevents Crash on Certain Network Devices
CVE-2026-23206
Summary
A bug in the Linux kernel's network driver for certain devices could cause the system to crash when it detects a device with zero network interfaces. This has been fixed to prevent the crash. Affected users should update their kernel to the fixed version to ensure system stability.
Original title
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
The driver allocates arrays for ports, FDBs, and filter bl...
Original description
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
The driver allocates arrays for ports, FDBs, and filter blocks using
kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the
device reports zero interfaces (either due to hardware configuration
or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10)
instead of NULL.
Later in dpaa2_switch_probe(), the NAPI initialization unconditionally
accesses ethsw->ports[0]->netdev, which attempts to dereference
ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic.
Add a check to ensure num_ifs is greater than zero after retrieving
device attributes. This prevents the zero-sized allocations and
subsequent invalid pointer dereference.
dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
The driver allocates arrays for ports, FDBs, and filter blocks using
kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the
device reports zero interfaces (either due to hardware configuration
or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10)
instead of NULL.
Later in dpaa2_switch_probe(), the NAPI initialization unconditionally
accesses ethsw->ports[0]->netdev, which attempts to dereference
ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic.
Add a check to ensure num_ifs is greater than zero after retrieving
device attributes. This prevents the zero-sized allocations and
subsequent invalid pointer dereference.
- https://git.kernel.org/stable/c/155eb99aff2920153bf21217ae29565fff81e6af
- https://git.kernel.org/stable/c/2fcccca88456b592bd668db13aa1d29ed257ca2b
- https://git.kernel.org/stable/c/4acc40db06ffd0fd92683505342b00c8a7394c60
- https://git.kernel.org/stable/c/80165ff16051448d6f840585ebe13f2400415df3
- https://git.kernel.org/stable/c/b97415c4362f739e25ec6f71012277086fabdf6f
- https://git.kernel.org/stable/c/ed48a84a72fefb20a82dd90a7caa7807e90c6f66
Published: 14 Feb 2026 · Updated: 10 Mar 2026 · First seen: 6 Mar 2026