CVE-2026-23000
- Source
- https://cve.org/CVERecord?id=CVE-2026-23000
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23000.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-23000
- Downstream
- Published
- 2026-01-25T14:36:14.854Z
- Modified
- 2026-02-09T19:34:30.144182Z
- Summary
- net/mlx5e: Fix crash on profile change rollback failure
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix crash on profile change rollback failure
mlx5enetdevchangeprofile can fail to attach a new profile and can fail to rollback to old profile, in such case, we could end up with a dangling netdev with a fully reset netdevpriv. A retry to change profile, e.g. another attempt to call mlx5enetdevchange_profile via switchdev mode change, will crash trying to access the now NULL priv->mdev.
This fix allows mlx5enetdevchange_profile() to handle previous failures and an empty priv, by not assuming priv is valid.
Pass netdev and mdev to all flows requiring mlx5enetdevchangeprofile() and avoid passing priv. In mlx5enetdevchangeprofile() check if current priv is valid, and if not, just attach the new profile without trying to access the old one.
This fixes the following oops, when enabling switchdev mode for the 2nd time after first time failure:
## Enabling switchdev mode first time:
mlx5core 0012:03:00.1: E-Switch: Supported tc chains and prios offload workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5core 0012:03:00.1: mlx5enetdevinitprofile:6214:(pid 37199): mlx5eprivinit failed, err=-12 mlx5core 0012:03:00.1 gpu3rdma1: mlx5enetdevchangeprofile: new profile init failed, -12 workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR mlx5core 0012:03:00.1: mlx5enetdevinitprofile:6214:(pid 37199): mlx5eprivinit failed, err=-12 mlx5core 0012:03:00.1 gpu3rdma1: mlx5enetdevchangeprofile: failed to rollback to orig profile, -12 ^^^^^^^^ mlx5core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)
## retry: Enabling switchdev mode 2nd time:
mlx5core 0000:00:03.0: E-Switch: Supported tc chains and prios offload BUG: kernel NULL pointer dereference, address: 0000000000000038 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 13 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc4+ #91 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:mlx5edetachnetdev+0x3c/0x90 Code: 50 00 00 f0 80 4f 78 02 48 8b bf e8 07 00 00 48 85 ff 74 16 48 8b 73 78 48 d1 ee 83 e6 01 83 f6 01 40 0f b6 f6 e8 c4 42 00 00 <48> 8b 45 38 48 85 c0 74 08 48 89 df e8 cc 47 40 1e 48 8b bb f0 07 RSP: 0018:ffffc90000673890 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8881036a89c0 RCX: 0000000000000000 RDX: ffff888113f63800 RSI: ffffffff822fe720 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000002dcd R09: 0000000000000000 R10: ffffc900006738e8 R11: 00000000ffffffff R12: 0000000000000000 R13: 0000000000000000 R14: ffff8881036a89c0 R15: 0000000000000000 FS: 00007fdfb8384740(0000) GS:ffff88856a9d6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000038 CR3: 0000000112ae0005 CR4: 0000000000370ef0 Call Trace: <TASK> mlx5enetdevchangeprofile+0x45/0xb0 mlx5evportrepload+0x27b/0x2d0 mlx5eswoffloadsrepload+0x72/0xf0 eswoffloadsenable+0x5d0/0x970 mlx5eswitchenablelocked+0x349/0x430 ? ismpsupported+0x57/0xb0 mlx5devlinkeswitchmodeset+0x26b/0x430 devlinknleswitchsetdoit+0x6f/0xf0 genlfamilyrcvmsgdoit+0xe8/0x140 genlrcvmsg+0x18b/0x290 ? _pfxdevlinknlpredoit+0x10/0x10 ? _pfxdevlinknleswitchsetdoit+0x10/0x10 ? _pfxdevlinknlpostdoit+0x10/0x10 ? _pfxgenlrcvmsg+0x10/0x10 netlinkrcvskb+0x52/0x100 genlrcv+0x28/0x40 netlinkunicast+0x282/0x3e0 ? _allocskb+0xd6/0x190 netlinksendmsg+0x1f7/0x430 _syssendto+0x213/0x220 ? _sysrecvmsg+0x6a/0xd0 _x64syssendto+0x24/0x30 dosyscall64+0x50/0x1f0 entrySYSCALL64after_hwframe+0x76/0x7e RIP: 0033:0x7fdfb8495047
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23000.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/4dadc4077e3f77d6d31e199a925fc7a705e7adeb
- https://git.kernel.org/stable/c/dad52950b409d6923880d65a4cddb383286e17d2
- https://git.kernel.org/stable/c/e05b8084a20f6bd5827d338c928e5e0fcbafa496
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23000.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-23000
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc4d7eb57687f358cd498ea3624519236af8db97eFixeddad52950b409d6923880d65a4cddb383286e17d2Fixede05b8084a20f6bd5827d338c928e5e0fcbafa496Fixed4dadc4077e3f77d6d31e199a925fc7a705e7adeb