LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23054: net: hv_netvsc: reject RSS hash key programming without RX indirection table

In the Linux kernel, the following vulnerability has been resolved: net: hv_netvsc: reject RSS hash key programming without RX indirection table RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_filter_device_add() does not allocate an indirection table, accepting RSS hash key updates in this state leads to a hang. Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return -EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device capabilities and prevents incorrect behavior.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

A Linux Hyper-V network driver can hang when software changes the Receive Side Scaling hash key on a single-queue device. The failure threatens availability rather than demonstrating data theft or code execution. Exposure depends on the hv_netvsc driver, device queue configuration, and whether RSS settings can be changed.

Executive priority

Treat this as a conditional availability issue. Inventory Hyper-V Linux workloads promptly and patch exposed, business-critical systems through normal kernel maintenance. Emergency action is not supported by the supplied evidence because severity, attack vector, and exploitation status remain unconfirmed.

Technical view

When hv_netvsc reports one receive queue, rndis_filter_device_add() does not allocate an RX indirection table. netvsc_set_rxfh() nevertheless accepted RSS hash-key programming, causing a hang. The upstream fix rejects the request with -EOPNOTSUPP when ndc->rx_table_sz is absent.

Likely exposure

Potentially exposed systems run an affected Linux kernel with the Hyper-V hv_netvsc network driver, a single receive queue, and a path that programs the RSS hash key. Ordinary Linux hosts, multi-queue configurations, and systems not using hv_netvsc are not shown by the bundle to encounter this condition.

Exploitation context

The supplied record is not in KEV and provides no evidence of active exploitation, public weaponization, or remote unauthenticated reachability. Triggering requires a specific driver state and RSS configuration action, but the sources do not establish what privileges or external access are required to initiate it.

Researcher notes

The defect is a missing capability guard in netvsc_set_rxfh(), not a demonstrated memory-corruption primitive. The fix checks ndc->rx_table_sz before accepting RSS configuration. The bundle lists affected versions but does not provide CVSS, CWE, privilege requirements, precise fixed-version mapping, or proof of external triggerability.

Mitigation direction

  • Apply a supported kernel update incorporating the cited hv_netvsc fix.
  • Check Linux distribution or appliance vendor guidance for the correct patched package.
  • Avoid RSS hash-key changes on single-queue hv_netvsc devices until patched.
  • Prioritize availability-sensitive Hyper-V workloads where a network-driver hang would be disruptive.

Validation and detection

  • Confirm whether each system uses the hv_netvsc network driver.
  • Identify affected kernel versions using vendor advisories and package changelogs.
  • Determine whether the virtual network device reports only one receive queue.
  • Verify the installed kernel contains the applicable cited stable fix.
  • After updating, confirm unsupported RSS changes are rejected without hanging.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23054 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux962f3fee83a4ef9010ae84dc43ae7aecb572e2a9, 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9, 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9, 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9, 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9unaffected
LinuxLinux4.11, 0, 6.1.162, 6.6.122, 6.12.67, 6.18.7, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.