Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash a system using the idpf network driver when an early network feature change is made before the interface is first brought up. The business impact is mainly availability: affected hosts may suffer a kernel crash, but the sources do not show remote exploitation or active exploitation.
Executive priority
Prioritize patching on production hosts that use idpf network devices, especially where a kernel crash would affect critical services. This is not presented as internet-exploitable in the provided sources, so urgency should be driven by host criticality and exposure to local network administration actions.
Technical view
In the idpf driver, the RSS lookup table was initialized during interface open. ethtool feature changes such as disabling rxhash before first interface up could dereference a NULL RSS LUT and trigger a kernel oops. The fix moves LUT initialization to vport creation and defers hardware programming when the interface is down.
Likely exposure
Exposure appears limited to Linux systems running affected kernels with the idpf driver loaded and idpf interfaces created. The trigger involves ethtool feature changes before first interface activation. Source version data is incomplete and should be mapped to vendor or distribution kernel packages.
Exploitation context
The source bundle provides a local reproduction path through ethtool and marks CISA KEV status as false. It does not cite active exploitation, remote exploitation, public exploit tooling, or privilege requirements. Treat this as a stability and local availability concern unless vendor guidance says otherwise.
Researcher notes
The affected version data in the bundle is sparse and partly ambiguous. The clearest root cause and fix details come from the kernel description and stable commit references. Do not infer broader driver families, remote reachability, or exploit maturity from this record alone.
Mitigation direction
- Apply kernel updates containing the referenced stable idpf fixes.
- Check Linux distribution advisories for package-specific fixed versions.
- Avoid pre-up ethtool rxhash changes on idpf interfaces until patched.
- If patching is delayed, restrict who can change network device features.
Validation and detection
- Inventory hosts using the idpf driver and affected kernel builds.
- Confirm whether idpf interfaces are created before first activation.
- Review operational scripts for early ethtool rxhash or RSS changes.
- Verify deployed kernels include one of the referenced stable commits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-22985 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/df2790b5228fbd3ed415b70a231cffdad0431618CVE reference, Linux
- https://git.kernel.org/stable/c/b29a5a7dd1f4293ee49c469938c25bf85a5aa802CVE reference, Linux
- https://git.kernel.org/stable/c/83f38f210b85676f40ba8586b5a8edae19b56995CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.