CVE-2026-23035 — NULL Pointer Dereference in Linux
Severity
5.1MEDIUM
No vectorEPSS
0.0%
top 98.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 31
Description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
mlx5e_priv is an unstable structure that can be memset(0) if profile
attaching fails.
Pass netdev to mlx5e_destroy_netdev() to guarantee it will work on a
valid netdev.
On mlx5e_remove: Check validity of priv->profile, before attempting
to cleanup any resources that might be not there.
This fixes a kernel oops in mlx5e_remove when switchdev mode fails due
to cha…
Affected Packages4 packages
▶CVEListV5linux/linuxc4d7eb57687f358cd498ea3624519236af8db97e — a7625bacaa8c8c2bfcde6dd6d1397bd63ad82b02+3
🔴Vulnerability Details
3OSV▶
CVE-2026-23035: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv mlx5e_priv is an un↗2026-01-31
GHSA▶
GHSA-5wr5-mxmx-fvmr: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
mlx5e_priv is an↗2026-01-31