In the Linux kernel, the following vulnerability has been resolved:
ixgbevf: add missing negotiate_features op to Hyper-V ops table
Commit a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by negotiating supported features") added the .negotiatefeatures callback to ixgbemacoperations and populated it in ixgbevfmacops, but forgot to add it to ixgbevfhvmacops. This leaves the function pointer NULL on Hyper-V VMs.
During probe, ixgbevfnegotiateapi() calls ixgbevfsetfeatures(), which unconditionally dereferences hw->mac.ops.negotiate_features(). On Hyper-V this results in a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine [...] Workqueue: events workforcpufn RIP: 0010:0x0 [...] Call Trace: ixgbevfnegotiateapi+0x66/0x160 [ixgbevf] ixgbevfswinit+0xe4/0x1f0 [ixgbevf] ixgbevfprobe+0x20f/0x4a0 [ixgbevf] localpciprobe+0x50/0xa0 workforcpu_fn+0x1a/0x30 [...]
Add ixgbevfhvnegotiatefeaturesvf() that returns -EOPNOTSUPP and wire it into ixgbevfhvmac_ops. The caller already handles -EOPNOTSUPP gracefully.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43094.json"
}