CVE-2026-43094

Vulnerability

Overview

In the Linux kernel's ixgbevf driver, a commit that added the .negotiate_features callback to support mailbox API compatibility (commit a7075f501bd3) failed to include this callback in the Hyper-V-specific operations table ixgbevf_hv_mac_ops [1]. As a result, the function pointer is left as NULL when the driver is used on a Hyper-V virtual machine.

Exploitation

Conditions

During driver probe, ixgbevf_negotiate_api() calls ixgbevf_set_features(), which unconditionally dereferences hw->mac.ops.negotiate_features() [2]. On a Hyper-V VM, this dereferences a NULL pointer, triggering a kernel crash (BUG: kernel NULL pointer dereference). The crash was observed with the following call trace: ixgbevf_negotiate_api, ixgbevf_sw_init, ixgbevf_probe, local_pci_probe, work_for_cpu_fn [3]. An attacker with local access or the ability to trigger a driver probe on a Hyper-V VM could cause a denial of service by crashing the system.

Impact

The vulnerability results in a denial of service (DoS) via a kernel panic (NULL pointer dereference). The CVSS v3 score is 5.5 (Medium), reflecting the requirement for local access to trigger the issue. No privilege escalation or data corruption has been reported.

Mitigation

The fix adds a new function ixgbevf_hv_negotiate_features_vf() that returns -EOPNOTSUPP and wires it into ixgbevf_hv_mac_ops [4]. The caller already handles -EOPNOTSUPP gracefully, preventing the crash. The patch has been applied to the stable kernel branches. Users should update to the latest kernel or apply the relevant commits.