Security readout for executives and security teams
Plain-English summary
CVE-2026-23173 is a Linux kernel mlx5 networking driver bug. Deleting traffic-control steering flows can touch a non-existent peer device and trigger a kernel NULL pointer dereference. The practical impact appears to be host instability or crash on affected systems, especially those using Mellanox mlx5 hardware and TC offload features.
Executive priority
Treat this as a targeted infrastructure reliability issue, not a broad internet-facing emergency. Patch during normal expedited kernel maintenance, with higher priority for network, virtualization, or appliance hosts using mlx5 offload capabilities.
Technical view
The fix changes mlx5e TC flow deletion to iterate only over actual devcom peers instead of assuming all possible ports exist. The reported failure occurs in mlx5e_tc_del_fdb_peers_flow during tc-triggered flow teardown, producing a supervisor-mode NULL pointer write at address 0x8.
Likely exposure
Exposure is likely limited to Linux systems running affected kernel versions or commits with mlx5_core and traffic-control offload paths in use. Generic Linux hosts without mlx5 hardware or TC steering flow workflows are less likely to be exposed based on the provided evidence.
Exploitation context
The source bundle does not show active exploitation, public weaponization, or KEV listing. The crash trace shows a tc process deleting qdisc/offload state, suggesting exploitation requires conditions that can trigger mlx5 TC flow cleanup rather than simple remote network traffic alone.
Researcher notes
Evidence supports a kernel availability failure in mlx5 TC cleanup, but not privilege escalation, data compromise, or remote exploitability. Version data is partly commit-based and partly release-based, so distro backport mapping is necessary before declaring a fleet affected or clean.
Mitigation direction
- Apply Linux kernel stable updates containing the referenced mlx5 fixes.
- Use distro kernel advisories to identify backported package versions.
- Prioritize hosts using Mellanox mlx5 devices and TC offload.
- Reboot or live-patch according to vendor operational guidance.
- If patching is delayed, review TC offload usage with the vendor.
Validation and detection
- Inventory Linux hosts for affected kernel versions listed in the CVE data.
- Identify systems loading mlx5_core or using Mellanox mlx5 hardware.
- Check whether TC flower/offload workflows are configured on those systems.
- Confirm installed kernels include one of the referenced stable fixes.
- Review logs for kernel oops traces involving mlx5e_tc_del_fdb_peers_flow.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23173 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/62e1d8920f6920543f4b095a65fb964448c9901dCVE reference, Linux
- https://git.kernel.org/stable/c/2652e2f1253c53f9a3ce84cc972568b32c892734CVE reference, Linux
- https://git.kernel.org/stable/c/fdf8437016f578f18b160c6e14f13ab96bfbc3baCVE reference, Linux
- https://git.kernel.org/stable/c/f67666938ae626cbda63fbf5176b3583c07e7124CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.