CVE-2026-22981 (GCVE-0-2026-22981)

Vulnerability from cvelistv5 – Published: 2026-01-23 15:24 – Updated: 2026-02-09 08:36
VLAI?
Title
idpf: detach and close netdevs while handling a reset
Summary
In the Linux kernel, the following vulnerability has been resolved: idpf: detach and close netdevs while handling a reset Protect the reset path from callbacks by setting the netdevs to detached state and close any netdevs in UP state until the reset handling has completed. During a reset, the driver will de-allocate resources for the vport, and there is no guarantee that those will recover, which is why the existing vport_ctrl_lock does not provide sufficient protection. idpf_detach_and_close() is called right before reset handling. If the reset handling succeeds, the netdevs state is recovered via call to idpf_attach_and_open(). If the reset handling fails the netdevs remain down. The detach/down calls are protected with RTNL lock to avoid racing with callbacks. On the recovery side the attach can be done without holding the RTNL lock as there are no callbacks expected at that point, due to detach/close always being done first in that flow. The previous logic restoring the netdevs state based on the IDPF_VPORT_UP_REQUESTED flag in the init task is not needed anymore, hence the removal of idpf_set_vport_state(). The IDPF_VPORT_UP_REQUESTED is still being used to restore the state of the netdevs following the reset, but has no use outside of the reset handling flow. idpf_init_hard_reset() is converted to void, since it was used as such and there is no error handling being done based on its return value. Before this change, invoking hard and soft resets simultaneously will cause the driver to lose the vport state: ip -br a <inf> UP echo 1 > /sys/class/net/ens801f0/device/reset& \ ethtool -L ens801f0 combined 8 ip -br a <inf> DOWN ip link set <inf> up ip -br a <inf> DOWN Also in case of a failure in the reset path, the netdev is left exposed to external callbacks, while vport resources are not initialized, leading to a crash on subsequent ifup/down: [408471.398966] idpf 0000:83:00.0: HW reset detected [408471.411744] idpf 0000:83:00.0: Device HW Reset initiated [408472.277901] idpf 0000:83:00.0: The driver was unable to contact the device's firmware. Check that the FW is running. Driver state= 0x2 [408508.125551] BUG: kernel NULL pointer dereference, address: 0000000000000078 [408508.126112] #PF: supervisor read access in kernel mode [408508.126687] #PF: error_code(0x0000) - not-present page [408508.127256] PGD 2aae2f067 P4D 0 [408508.127824] Oops: Oops: 0000 [#1] SMP NOPTI ... [408508.130871] RIP: 0010:idpf_stop+0x39/0x70 [idpf] ... [408508.139193] Call Trace: [408508.139637] <TASK> [408508.140077] __dev_close_many+0xbb/0x260 [408508.140533] __dev_change_flags+0x1cf/0x280 [408508.140987] netif_change_flags+0x26/0x70 [408508.141434] dev_change_flags+0x3d/0xb0 [408508.141878] devinet_ioctl+0x460/0x890 [408508.142321] inet_ioctl+0x18e/0x1d0 [408508.142762] ? _copy_to_user+0x22/0x70 [408508.143207] sock_do_ioctl+0x3d/0xe0 [408508.143652] sock_ioctl+0x10e/0x330 [408508.144091] ? find_held_lock+0x2b/0x80 [408508.144537] __x64_sys_ioctl+0x96/0xe0 [408508.144979] do_syscall_64+0x79/0x3d0 [408508.145415] entry_SYSCALL_64_after_hwframe+0x76/0x7e [408508.145860] RIP: 0033:0x7f3e0bb4caff
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0fe45467a1041ea3657a7fa3a791c84c104fbd34 , < ac122f5fb050903b3d262001562c452be95eaf70 (git)
Affected: 0fe45467a1041ea3657a7fa3a791c84c104fbd34 , < 2e281e1155fc476c571c0bd2ffbfe28ab829a5c3 (git)
Create a notification for this product.
    Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.18.6 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ac122f5fb050903b3d262001562c452be95eaf70",
              "status": "affected",
              "version": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
              "versionType": "git"
            },
            {
              "lessThan": "2e281e1155fc476c571c0bd2ffbfe28ab829a5c3",
              "status": "affected",
              "version": "0fe45467a1041ea3657a7fa3a791c84c104fbd34",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/idpf/idpf_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: detach and close netdevs while handling a reset\n\nProtect the reset path from callbacks by setting the netdevs to detached\nstate and close any netdevs in UP state until the reset handling has\ncompleted. During a reset, the driver will de-allocate resources for the\nvport, and there is no guarantee that those will recover, which is why the\nexisting vport_ctrl_lock does not provide sufficient protection.\n\nidpf_detach_and_close() is called right before reset handling. If the\nreset handling succeeds, the netdevs state is recovered via call to\nidpf_attach_and_open(). If the reset handling fails the netdevs remain\ndown. The detach/down calls are protected with RTNL lock to avoid racing\nwith callbacks. On the recovery side the attach can be done without\nholding the RTNL lock as there are no callbacks expected at that point,\ndue to detach/close always being done first in that flow.\n\nThe previous logic restoring the netdevs state based on the\nIDPF_VPORT_UP_REQUESTED flag in the init task is not needed anymore, hence\nthe removal of idpf_set_vport_state(). The IDPF_VPORT_UP_REQUESTED is\nstill being used to restore the state of the netdevs following the reset,\nbut has no use outside of the reset handling flow.\n\nidpf_init_hard_reset() is converted to void, since it was used as such and\nthere is no error handling being done based on its return value.\n\nBefore this change, invoking hard and soft resets simultaneously will\ncause the driver to lose the vport state:\nip -br a\n\u003cinf\u003e\tUP\necho 1 \u003e /sys/class/net/ens801f0/device/reset\u0026 \\\nethtool -L ens801f0 combined 8\nip -br a\n\u003cinf\u003e\tDOWN\nip link set \u003cinf\u003e up\nip -br a\n\u003cinf\u003e\tDOWN\n\nAlso in case of a failure in the reset path, the netdev is left\nexposed to external callbacks, while vport resources are not\ninitialized, leading to a crash on subsequent ifup/down:\n[408471.398966] idpf 0000:83:00.0: HW reset detected\n[408471.411744] idpf 0000:83:00.0: Device HW Reset initiated\n[408472.277901] idpf 0000:83:00.0: The driver was unable to contact the device\u0027s firmware. Check that the FW is running. Driver state= 0x2\n[408508.125551] BUG: kernel NULL pointer dereference, address: 0000000000000078\n[408508.126112] #PF: supervisor read access in kernel mode\n[408508.126687] #PF: error_code(0x0000) - not-present page\n[408508.127256] PGD 2aae2f067 P4D 0\n[408508.127824] Oops: Oops: 0000 [#1] SMP NOPTI\n...\n[408508.130871] RIP: 0010:idpf_stop+0x39/0x70 [idpf]\n...\n[408508.139193] Call Trace:\n[408508.139637]  \u003cTASK\u003e\n[408508.140077]  __dev_close_many+0xbb/0x260\n[408508.140533]  __dev_change_flags+0x1cf/0x280\n[408508.140987]  netif_change_flags+0x26/0x70\n[408508.141434]  dev_change_flags+0x3d/0xb0\n[408508.141878]  devinet_ioctl+0x460/0x890\n[408508.142321]  inet_ioctl+0x18e/0x1d0\n[408508.142762]  ? _copy_to_user+0x22/0x70\n[408508.143207]  sock_do_ioctl+0x3d/0xe0\n[408508.143652]  sock_ioctl+0x10e/0x330\n[408508.144091]  ? find_held_lock+0x2b/0x80\n[408508.144537]  __x64_sys_ioctl+0x96/0xe0\n[408508.144979]  do_syscall_64+0x79/0x3d0\n[408508.145415]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[408508.145860] RIP: 0033:0x7f3e0bb4caff"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-09T08:36:31.328Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ac122f5fb050903b3d262001562c452be95eaf70"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e281e1155fc476c571c0bd2ffbfe28ab829a5c3"
        }
      ],
      "title": "idpf: detach and close netdevs while handling a reset",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-22981",
    "datePublished": "2026-01-23T15:24:03.772Z",
    "dateReserved": "2026-01-13T15:37:45.936Z",
    "dateUpdated": "2026-02-09T08:36:31.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-22981\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-23T16:15:54.117\",\"lastModified\":\"2026-02-26T18:48:21.750\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nidpf: detach and close netdevs while handling a reset\\n\\nProtect the reset path from callbacks by setting the netdevs to detached\\nstate and close any netdevs in UP state until the reset handling has\\ncompleted. During a reset, the driver will de-allocate resources for the\\nvport, and there is no guarantee that those will recover, which is why the\\nexisting vport_ctrl_lock does not provide sufficient protection.\\n\\nidpf_detach_and_close() is called right before reset handling. If the\\nreset handling succeeds, the netdevs state is recovered via call to\\nidpf_attach_and_open(). If the reset handling fails the netdevs remain\\ndown. The detach/down calls are protected with RTNL lock to avoid racing\\nwith callbacks. On the recovery side the attach can be done without\\nholding the RTNL lock as there are no callbacks expected at that point,\\ndue to detach/close always being done first in that flow.\\n\\nThe previous logic restoring the netdevs state based on the\\nIDPF_VPORT_UP_REQUESTED flag in the init task is not needed anymore, hence\\nthe removal of idpf_set_vport_state(). The IDPF_VPORT_UP_REQUESTED is\\nstill being used to restore the state of the netdevs following the reset,\\nbut has no use outside of the reset handling flow.\\n\\nidpf_init_hard_reset() is converted to void, since it was used as such and\\nthere is no error handling being done based on its return value.\\n\\nBefore this change, invoking hard and soft resets simultaneously will\\ncause the driver to lose the vport state:\\nip -br a\\n\u003cinf\u003e\\tUP\\necho 1 \u003e /sys/class/net/ens801f0/device/reset\u0026 \\\\\\nethtool -L ens801f0 combined 8\\nip -br a\\n\u003cinf\u003e\\tDOWN\\nip link set \u003cinf\u003e up\\nip -br a\\n\u003cinf\u003e\\tDOWN\\n\\nAlso in case of a failure in the reset path, the netdev is left\\nexposed to external callbacks, while vport resources are not\\ninitialized, leading to a crash on subsequent ifup/down:\\n[408471.398966] idpf 0000:83:00.0: HW reset detected\\n[408471.411744] idpf 0000:83:00.0: Device HW Reset initiated\\n[408472.277901] idpf 0000:83:00.0: The driver was unable to contact the device\u0027s firmware. Check that the FW is running. Driver state= 0x2\\n[408508.125551] BUG: kernel NULL pointer dereference, address: 0000000000000078\\n[408508.126112] #PF: supervisor read access in kernel mode\\n[408508.126687] #PF: error_code(0x0000) - not-present page\\n[408508.127256] PGD 2aae2f067 P4D 0\\n[408508.127824] Oops: Oops: 0000 [#1] SMP NOPTI\\n...\\n[408508.130871] RIP: 0010:idpf_stop+0x39/0x70 [idpf]\\n...\\n[408508.139193] Call Trace:\\n[408508.139637]  \u003cTASK\u003e\\n[408508.140077]  __dev_close_many+0xbb/0x260\\n[408508.140533]  __dev_change_flags+0x1cf/0x280\\n[408508.140987]  netif_change_flags+0x26/0x70\\n[408508.141434]  dev_change_flags+0x3d/0xb0\\n[408508.141878]  devinet_ioctl+0x460/0x890\\n[408508.142321]  inet_ioctl+0x18e/0x1d0\\n[408508.142762]  ? _copy_to_user+0x22/0x70\\n[408508.143207]  sock_do_ioctl+0x3d/0xe0\\n[408508.143652]  sock_ioctl+0x10e/0x330\\n[408508.144091]  ? find_held_lock+0x2b/0x80\\n[408508.144537]  __x64_sys_ioctl+0x96/0xe0\\n[408508.144979]  do_syscall_64+0x79/0x3d0\\n[408508.145415]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n[408508.145860] RIP: 0033:0x7f3e0bb4caff\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.18.6\",\"matchCriteriaId\":\"C006C634-C236-4B4B-B7FA-AF44C3098505\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2e281e1155fc476c571c0bd2ffbfe28ab829a5c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ac122f5fb050903b3d262001562c452be95eaf70\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.