Skip to main content

Linux Kernel CVE-2026-43094

| EUVDEUVD-2026-27598 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-06 Linux GHSA-8c3v-5v6w-588p
Microsoft Linux Null Pointer Dereference Denial Of Service
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
May 19, 2026 - 23:01 vuln.today
CVSS changed
May 19, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 11:31 EUVD

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ixgbevf: add missing negotiate_features op to Hyper-V ops table

Commit a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by negotiating supported features") added the .negotiate_features callback to ixgbe_mac_operations and populated it in ixgbevf_mac_ops, but forgot to add it to ixgbevf_hv_mac_ops. This leaves the function pointer NULL on Hyper-V VMs.

During probe, ixgbevf_negotiate_api() calls ixgbevf_set_features(), which unconditionally dereferences hw->mac.ops.negotiate_features(). On Hyper-V this results in a NULL pointer dereference:

BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine [...] Workqueue: events work_for_cpu_fn RIP: 0010:0x0 [...] Call Trace: ixgbevf_negotiate_api+0x66/0x160 [ixgbevf] ixgbevf_sw_init+0xe4/0x1f0 [ixgbevf] ixgbevf_probe+0x20f/0x4a0 [ixgbevf] local_pci_probe+0x50/0xa0 work_for_cpu_fn+0x1a/0x30 [...]

Add ixgbevf_hv_negotiate_features_vf() that returns -EOPNOTSUPP and wire it into ixgbevf_hv_mac_ops. The caller already handles -EOPNOTSUPP gracefully.

AnalysisAI

NULL pointer dereference in the Linux kernel ixgbevf driver crashes Hyper-V guest VMs during device probe, causing a kernel panic and complete denial of service. The regression was introduced when commit a7075f501bd3 added a .negotiate_features callback to ixgbe_mac_operations and populated it for the standard ops table (ixgbevf_mac_ops) but omitted it from the Hyper-V-specific table (ixgbevf_hv_mac_ops), leaving that pointer NULL on Hyper-V guests. Any Linux system running on Microsoft Hyper-V with an Intel ixgbevf virtual NIC is subject to an automatic kernel crash at module load or boot; no public exploit has been identified at time of analysis and EPSS is 0.02%, reflecting a narrow but reliable impact on the specific deployment combination.

Technical ContextAI

The ixgbevf kernel module provides Linux guest support for Intel 82599/X540/X550 10-GbE SR-IOV virtual functions. The module defines a mac operations dispatch table (ixgbe_mac_operations) containing function pointers invoked at various stages of driver lifecycle. Two instantiations of this table exist: ixgbevf_mac_ops for standard environments and ixgbevf_hv_mac_ops for the Microsoft Hyper-V code path, which requires different mailbox handling. Commit a7075f501bd3 introduced .negotiate_features to ixgbe_mac_operations and wired it into ixgbevf_mac_ops, but the parallel Hyper-V table was not updated. During probe, ixgbevf_sw_init() → ixgbevf_negotiate_api() → ixgbevf_set_features() unconditionally calls hw->mac.ops.negotiate_features(), which on Hyper-V resolves to address 0x0, triggering CWE-476 (NULL Pointer Dereference). The fix adds a stub ixgbevf_hv_negotiate_features_vf() returning -EOPNOTSUPP - an error the caller already handles gracefully - and wires it into ixgbevf_hv_mac_ops. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across multiple stable branches introduced after commit a7075f501bd3.

RemediationAI

Vendor-released patches are confirmed available via the Linux stable kernel git. Upgrade to kernel 6.6.136 or later for the 6.6.x stable branch (fix commit: https://git.kernel.org/stable/c/2270ebab53128fb73c4a70a292be09094074737f), 6.12.83 or later for 6.12.x (https://git.kernel.org/stable/c/4db7b61ec1d1b2b67c0881b62fc4f9583bc21484), 6.18.24 or later for 6.18.x (https://git.kernel.org/stable/c/1455ff8809843e6e83f1f5b5c0bcc2224c99a3cb), 6.19.14 or later for 6.19.x (https://git.kernel.org/stable/c/4821d563cd7f251ae728be1a6d04af82a294a5b9), or Linux 7.0 once generally available. For systems that cannot be immediately patched, blacklisting the ixgbevf module (add 'blacklist ixgbevf' to /etc/modprobe.d/blacklist.conf and update initramfs) prevents the crash but disables the Intel vNIC entirely; the guest must then rely on the Hyper-V synthetic NIC (hv_netvsc driver), which requires network reconfiguration and may have performance or feature differences. This workaround is disruptive and should be treated as temporary pending a kernel update. Additional advisory context is available at https://nvd.nist.gov/vuln/detail/CVE-2026-43094.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Null Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43094 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy