CVE-2026-23206

dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero

published February 14, 2026

CVSS
—
EPSS
0%
Percentile
2.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero

The driver allocates arrays for ports, FDBs, and filter blocks using

kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the

device reports zero interfaces (either due to hardware configuration

or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10)

instead of NULL.

Later in dpaa2_switch_probe(), the NAPI initialization unconditionally

accesses ethsw->ports[0]->netdev, which attempts to dereference

ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic.

Add a check to ensure num_ifs is greater than zero after retrieving

device attributes. This prevents the zero-sized allocations and

subsequent invalid pointer dereference.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00134 · 2.6th percentile
Published
2026-02-14T16:27Z
EPSS history
Timeline
  • 14 FEB 16:27Z
    dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
    cvelistv5