LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport

In the Linux kernel, the following vulnerability has been resolved: idpf: fix aux device unplugging when rdma is not supported by vport If vport flags do not contain VIRTCHNL2_VPORT_ENABLE_RDMA, driver does not allocate vdev_info for this vport. This leads to kernel NULL pointer dereference in idpf_idc_vport_dev_down(), which references vdev_info for every vport regardless. Check, if vdev_info was ever allocated before unplugging aux device.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can cause a null pointer dereference in the idpf network driver during device shutdown when a vport lacks RDMA support. The likely business impact is host availability disruption. Public sources do not state severity, exploitability, or active exploitation.

Executive priority

Treat as a targeted Linux infrastructure maintenance item, not an internet-wide emergency based on current evidence. Prioritize affected network-intensive hosts and virtualization platforms once vendor packages are available.

Technical view

When VIRTCHNL2_VPORT_ENABLE_RDMA is absent, idpf does not allocate vdev_info for that vport. idpf_idc_vport_dev_down() still references vdev_info for every vport while unplugging the auxiliary device. The stable fix adds an allocation check before unplugging.

Likely exposure

Likely limited to Linux systems using affected kernel versions with the idpf driver and vports where RDMA is not supported or enabled. Confirm exposure by checking deployed kernel versions, loaded idpf module usage, and relevant Intel network hardware or virtual NIC configuration.

Exploitation context

The source bundle does not report active exploitation, public exploit code, KEV listing, CVSS, required privileges, or attack vector. Based on the description, the observable failure is a kernel NULL pointer dereference, commonly an availability concern, but triggerability is not fully described.

Researcher notes

Evidence is limited to the CVE description and two Linux stable commit references. No CWE, CVSS, exploit status, or detailed reproduction path is provided. Avoid assuming remote reachability or privilege requirements without vendor confirmation.

Mitigation direction

  • Apply a kernel update containing the referenced stable idpf fix.
  • Follow Linux distribution or vendor advisories for backported packages.
  • Prioritize hosts using idpf-supported Intel network devices or virtual functions.
  • If patching is delayed, review vendor guidance for safe operational workarounds.

Validation and detection

  • Inventory Linux kernel versions against the affected range in the CVE record.
  • Check whether the idpf driver is present or loaded on each host.
  • Identify systems using relevant Intel network devices, vports, or virtual functions.
  • Confirm installed kernel packages include the stable fix or vendor backport.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23042 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbe91128c579c86d295da4325f6ac4710e4e6d2b4, be91128c579c86d295da4325f6ac4710e4e6d2b4unaffected
LinuxLinux6.17, 0, 6.18.6, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.