CVE-2026-23054

Root

Cause

The vulnerability resides in the hv_netvsc driver within the Linux kernel. When the underlying Hyper-V network device reports only a single receive queue, the driver's initialization function rndis_filter_device_add() skips allocating a receive (RX) indirection table. However, the netvsc_set_rxfh() function, responsible for programming the RSS hash key, did not check for the presence of this table before accepting a new key. This led to an invalid state, causing a kernel hang.

Exploitation

An attacker with the ability to set RSS hash keys on a affected virtual NIC can trigger this vulnerability. The exploit requires local access sufficient to invoke the ETHTOOL_SRSSH command on the network device. The attack does not require more than basic user privileges, as the hang occurs at the kernel level. The prerequisite is a device that reports a single receive queue, which is a common configuration.

Impact

Successful exploitation results in a system hang or denial of service (DoS). The kernel becomes unresponsive, affecting all processes and services on the host. This vulnerability can be used by a malicious user to disrupt operations on a multi-tenant Hyper-V host or a guest virtual machine.

Mitigation

The fix is implemented in Linux kernel commits [1] and [2], which add a check for ndc->rx_table_sz in netvsc_set_rxfh(). If the indirection table is absent, the function returns -EOPNOTSUPP, preventing the hang. Administrators should apply the latest stable kernel updates containing these commits. No workaround other than patching is known.