{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-22985",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-22985",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-01-23T15:24:07.133Z",
    "updatedAt": "2026-05-11T21:57:46.297Z",
    "importedAt": "2026-10-24T01:58:02.025Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "idpf: Fix RSS LUT NULL pointer crash on early ethtool operations",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: Fix RSS LUT NULL pointer crash on early ethtool operations\n\nThe RSS LUT is not initialized until the interface comes up, causing\nthe following NULL pointer crash when ethtool operations like rxhash on/off\nare performed before the interface is brought up for the first time.\n\nMove RSS LUT initialization from ndo_open to vport creation to ensure LUT\nis always available. This enables RSS configuration via ethtool before\nbringing the interface up. Simplify LUT management by maintaining all\nchanges in the driver's soft copy and programming zeros to the indirection\ntable when rxhash is disabled. Defer HW programming until the interface\ncomes up if it is down during rxhash and LUT configuration changes.\n\nSteps to reproduce:\n** Load idpf driver; interfaces will be created\n\tmodprobe idpf\n** Before bringing the interfaces up, turn rxhash off\n\tethtool -K eth2 rxhash off\n\n[89408.371875] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[89408.371908] #PF: supervisor read access in kernel mode\n[89408.371924] #PF: error_code(0x0000) - not-present page\n[89408.371940] PGD 0 P4D 0\n[89408.371953] Oops: Oops: 0000 [#1] SMP NOPTI\n<snip>\n[89408.372052] RIP: 0010:memcpy_orig+0x16/0x130\n[89408.372310] Call Trace:\n[89408.372317]  <TASK>\n[89408.372326]  ? idpf_set_features+0xfc/0x180 [idpf]\n[89408.372363]  __netdev_update_features+0x295/0xde0\n[89408.372384]  ethnl_set_features+0x15e/0x460\n[89408.372406]  genl_family_rcv_msg_doit+0x11f/0x180\n[89408.372429]  genl_rcv_msg+0x1ad/0x2b0\n[89408.372446]  ? __pfx_ethnl_set_features+0x10/0x10\n[89408.372465]  ? __pfx_genl_rcv_msg+0x10/0x10\n[89408.372482]  netlink_rcv_skb+0x58/0x100\n[89408.372502]  genl_rcv+0x2c/0x50\n[89408.372516]  netlink_unicast+0x289/0x3e0\n[89408.372533]  netlink_sendmsg+0x215/0x440\n[89408.372551]  __sys_sendto+0x234/0x240\n[89408.372571]  __x64_sys_sendto+0x28/0x30\n[89408.372585]  x64_sys_call+0x1909/0x1da0\n[89408.372604]  do_syscall_64+0x7a/0xfa0\n[89408.373140]  ? clear_bhb_loop+0x60/0xb0\n[89408.373647]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[89408.378887]  </TASK>\n<snip>",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "a251eee62133774cf35ff829041377e721ef9c8c",
              "status": "affected",
              "versionType": "git",
              "lessThan": "df2790b5228fbd3ed415b70a231cffdad0431618"
            },
            {
              "version": "a251eee62133774cf35ff829041377e721ef9c8c",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b29a5a7dd1f4293ee49c469938c25bf85a5aa802"
            },
            {
              "version": "a251eee62133774cf35ff829041377e721ef9c8c",
              "status": "affected",
              "versionType": "git",
              "lessThan": "83f38f210b85676f40ba8586b5a8edae19b56995"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.7",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.7"
            },
            {
              "version": "6.12.80",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.6",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "6.19",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}