1. Home
  2. Vulnerabilities
  3. CVE-2026-23206
0.0
NA
CVE-2026-23206
dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
Description

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the device reports zero interfaces (either due to hardware configuration or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10) instead of NULL. Later in dpaa2_switch_probe(), the NAPI initialization unconditionally accesses ethsw->ports[0]->netdev, which attempts to dereference ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic. Add a check to ensure num_ifs is greater than zero after retrieving device attributes. This prevents the zero-sized allocations and subsequent invalid pointer dereference.

INFO

Published Date :

Feb. 14, 2026, 5:15 p.m.

Last Modified :

Feb. 14, 2026, 5:15 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-23206 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Solution
Prevent kernel panic by validating interface count before allocation and access.
  • Ensure num_ifs is greater than zero.
  • Check device attributes after retrieval.
  • Add validation for zero-sized allocations.
  • Update the dpaa2-switch driver.
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-23206.

URL Resource
https://git.kernel.org/stable/c/155eb99aff2920153bf21217ae29565fff81e6af
https://git.kernel.org/stable/c/2fcccca88456b592bd668db13aa1d29ed257ca2b
https://git.kernel.org/stable/c/4acc40db06ffd0fd92683505342b00c8a7394c60
https://git.kernel.org/stable/c/80165ff16051448d6f840585ebe13f2400415df3
https://git.kernel.org/stable/c/b97415c4362f739e25ec6f71012277086fabdf6f
https://git.kernel.org/stable/c/ed48a84a72fefb20a82dd90a7caa7807e90c6f66
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-23206 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-23206 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-23206 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-23206 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Feb. 14, 2026

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the device reports zero interfaces (either due to hardware configuration or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10) instead of NULL. Later in dpaa2_switch_probe(), the NAPI initialization unconditionally accesses ethsw->ports[0]->netdev, which attempts to dereference ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic. Add a check to ensure num_ifs is greater than zero after retrieving device attributes. This prevents the zero-sized allocations and subsequent invalid pointer dereference.
    Added Reference https://git.kernel.org/stable/c/155eb99aff2920153bf21217ae29565fff81e6af
    Added Reference https://git.kernel.org/stable/c/2fcccca88456b592bd668db13aa1d29ed257ca2b
    Added Reference https://git.kernel.org/stable/c/4acc40db06ffd0fd92683505342b00c8a7394c60
    Added Reference https://git.kernel.org/stable/c/80165ff16051448d6f840585ebe13f2400415df3
    Added Reference https://git.kernel.org/stable/c/b97415c4362f739e25ec6f71012277086fabdf6f
    Added Reference https://git.kernel.org/stable/c/ed48a84a72fefb20a82dd90a7caa7807e90c6f66
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
No CVSS metrics available for this vulnerability.