CVE-2026-23054

CVE-2026-23054

published February 4, 2026

CVSS
—
EPSS
0%
Percentile
9.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: hv_netvsc: reject RSS hash key programming without RX indirection table

RSS configuration requires a valid RX indirection table. When the device

reports a single receive queue, rndis_filter_device_add() does not

allocate an indirection table, accepting RSS hash key updates in this

state leads to a hang.

Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return

-EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device

capabilities and prevents incorrect behavior.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.7th percentile
Published
2026-02-04T22:16Z
References (7)
EPSS history
Timeline
  • 04 FEB 16:04Z
    net: hv_netvsc: reject RSS hash key programming without RX indirection table
    cvelistv5