LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23017: idpf: fix error handling in the init_task on load

In the Linux kernel, the following vulnerability has been resolved: idpf: fix error handling in the init_task on load If the init_task fails during a driver load, we end up without vports and netdevs, effectively failing the entire process. In that state a subsequent reset will result in a crash as the service task attempts to access uninitialized resources. Following trace is from an error in the init_task where the CREATE_VPORT (op 501) is rejected by the FW: [40922.763136] idpf 0000:83:00.0: Device HW Reset initiated [40924.449797] idpf 0000:83:00.0: Transaction failed (op 501) [40958.148190] idpf 0000:83:00.0: HW reset detected [40958.161202] BUG: kernel NULL pointer dereference, address: 00000000000000a8 ... [40958.168094] Workqueue: idpf-0000:83:00.0-vc_event idpf_vc_event_task [idpf] [40958.168865] RIP: 0010:idpf_vc_event_task+0x9b/0x350 [idpf] ... [40958.177932] Call Trace: [40958.178491] <TASK> [40958.179040] process_one_work+0x226/0x6d0 [40958.179609] worker_thread+0x19e/0x340 [40958.180158] ? __pfx_worker_thread+0x10/0x10 [40958.180702] kthread+0x10f/0x250 [40958.181238] ? __pfx_kthread+0x10/0x10 [40958.181774] ret_from_fork+0x251/0x2b0 [40958.182307] ? __pfx_kthread+0x10/0x10 [40958.182834] ret_from_fork_asm+0x1a/0x30 [40958.183370] </TASK> Fix the error handling in the init_task to make sure the service and mailbox tasks are disabled if the error happens during load. These are started in idpf_vc_core_init(), which spawns the init_task and has no way of knowing if it failed. If the error happens on reset, following successful driver load, the tasks can still run, as that will allow the netdevs to attempt recovery through another reset. Stop the PTP callbacks either way as those will be restarted by the call to idpf_vc_core_init() during a successful reset.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel driver reliability flaw in idpf. If driver initialization fails and a later hardware reset occurs, the kernel can crash because background tasks access resources that were never initialized. The main business impact is potential outage on affected systems using this driver, not confirmed data theft or remote compromise.

Executive priority

Treat this as an availability-risk item for affected Linux networking hosts. Prioritize patching where idpf hardware or modules are present, especially in production systems where kernel crashes would disrupt services.

Technical view

The idpf init_task error path can leave service and mailbox tasks running after failed driver load without vports or netdevs. A subsequent reset may trigger NULL pointer dereference in idpf_vc_event_task. The fix disables those tasks on load-time failure and stops PTP callbacks appropriately.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions or commits with the idpf driver in use. The bundle lists Linux kernel versions including 6.7, 6.18.6, and 6.19, but affected-version boundaries are not fully clear from the provided data.

Exploitation context

No active exploitation is indicated in the bundle, and KEV status is false. The source describes a crash after driver load failure and later reset, including firmware rejection of CREATE_VPORT, but does not describe a remote attack path.

Researcher notes

Evidence is limited to the CVE text and kernel stable references. No CVSS, CWE, exploit status, or detailed distro mapping is provided. The vulnerability is best tracked as an idpf error-handling flaw causing a NULL pointer crash after failed initialization and reset.

Mitigation direction

  • Update to a Linux kernel containing the referenced stable fixes.
  • Track your Linux distribution advisory for backported idpf fixes.
  • Prioritize systems using idpf-supported networking hardware.
  • If no update is available, follow vendor guidance for interim controls.

Validation and detection

  • Inventory Linux kernels and determine whether idpf is present or loaded.
  • Check package changelogs for the referenced stable commit IDs.
  • Review kernel logs for idpf initialization failures followed by hardware resets.
  • Confirm updated systems no longer show the described idpf crash pattern.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23017 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0fe45467a1041ea3657a7fa3a791c84c104fbd34, 0fe45467a1041ea3657a7fa3a791c84c104fbd34unaffected
LinuxLinux6.7, 0, 6.18.6, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.