Skip to main content

Linux Kernel CVE-2026-43282

| EUVDEUVD-2026-27679 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-06 Linux GHSA-5g7g-fprm-cgpp
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only driver path requires low-privilege local access; kernel panic yields full availability loss with zero confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:40 vuln.today
CVSS changed
May 08, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:29 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port

The function ionic_query_port() calls ib_device_get_netdev() without checking the return value which could lead to NULL pointer dereference, Fix it by checking the return value and return -ENODEV if the 'ndev' is NULL.

AnalysisAI

NULL pointer dereference in the Linux kernel's RDMA/ionic driver allows a local low-privileged user to crash the kernel by triggering the ionic_query_port() function when the associated network device is unavailable. The root cause is an unchecked return value from ib_device_get_netdev(), which can return NULL during device absence or hot-unplug transitions - leading to a kernel panic and complete denial of service. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) confirms this is not being actively targeted.

Technical ContextAI

The vulnerability resides in the RDMA (Remote Direct Memory Access) subsystem's ionic driver (drivers/infiniband/hw/ionic/), which provides InfiniBand device support for Pensando/AMD ionic network adapters. The root cause is CWE-476 (NULL Pointer Dereference): ionic_query_port() calls ib_device_get_netdev() to retrieve the kernel network device struct (ndev) associated with the IB port, but does not validate the return value before dereferencing it. If the netdev is absent - such as during device initialization, hot-unplug, or a race condition - the function receives a NULL pointer and the subsequent memory access causes a kernel oops or panic. The fix introduces a NULL check returning -ENODEV when ndev is NULL. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, scoped to kernels shipping the ionic RDMA driver from the introducing commit 2075bbe8ef03 onward.

RemediationAI

Upgrade to Linux kernel 6.18.16 or 6.19.6 (or any later release), which incorporate the NULL pointer check in ionic_query_port(). The three upstream stable fix commits are at https://git.kernel.org/stable/c/2b96156c927cd83c109e2e3946e6111dce73231f, https://git.kernel.org/stable/c/81932a46dfd0db10a03f46f0b1c7ef946ac4552f, and https://git.kernel.org/stable/c/fd80bd7105f88189f47d465ca8cb7d115570de30. Red Hat and SUSE users should consult their vendor advisory channels for backported errata, as the EUVD listing (EUVD-2026-27679) references both vendors. As an immediate compensating control on systems where patching is not feasible, blacklisting the rdma_ionic kernel module (e.g., echo 'blacklist rdma_ionic' >> /etc/modprobe.d/blacklist.conf and rebooting) will prevent the driver from loading and eliminate the attack surface - though this disables all RDMA functionality on ionic adapters and impacts workloads dependent on RDMA (MPI-based HPC, RDMA-backed storage). This trade-off is acceptable only if RDMA is non-critical in the environment.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43282 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy