CVE-2026-23206

Source
https://cve.org/CVERecord?id=CVE-2026-23206
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23206.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-23206
Downstream
Published
2026-02-14T16:27:29.095Z
Modified
2026-03-20T12:47:27.121675Z
Summary
dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
Details

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: prevent ZEROSIZEPTR dereference when num_ifs is zero

The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc() with ethsw->swattr.numifs as the element count. When the device reports zero interfaces (either due to hardware configuration or firmware issues), kcalloc(0, ...) returns ZEROSIZEPTR (0x10) instead of NULL.

Later in dpaa2switchprobe(), the NAPI initialization unconditionally accesses ethsw->ports[0]->netdev, which attempts to dereference ZEROSIZEPTR (address 0x10), resulting in a kernel panic.

Add a check to ensure num_ifs is greater than zero after retrieving device attributes. This prevents the zero-sized allocations and subsequent invalid pointer dereference.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23206.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0b1b71370458860579831e77485883fcf2e8fbbe
Fixed
2fcccca88456b592bd668db13aa1d29ed257ca2b
Fixed
80165ff16051448d6f840585ebe13f2400415df3
Fixed
b97415c4362f739e25ec6f71012277086fabdf6f
Fixed
4acc40db06ffd0fd92683505342b00c8a7394c60
Fixed
155eb99aff2920153bf21217ae29565fff81e6af
Fixed
ed48a84a72fefb20a82dd90a7caa7807e90c6f66

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23206.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.13.0
Fixed
5.15.200
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.163
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.124
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.70
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.10

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23206.json"