Riskcovery

CVE-2026-23054

net: hv_netvsc: reject RSS hash key programming without RX indirection table

State
Published
Severity
Not scored
Published
Feb 4, 2026
Updated
Oct 15, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: hv_netvsc: reject RSS hash key programming without RX indirection table

RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_filter_device_add() does not allocate an indirection table, accepting RSS hash key updates in this state leads to a hang.

Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return -EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device capabilities and prevents incorrect behavior.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9 to before 8288136f508e78eb3563e7073975999cf225a2f9Affected
  • 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9 to before 82c9039c8ebb715753a40434df714f865a3aec9cAffected
  • 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9 to before 4cd55c609e85ae2313248ef1a33619a3eef44a16Affected
  • 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9 to before 11dd9a9ef4dc4507a15a69b8511a0013c6c28fa3Affected
  • 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9 to before d23564955811da493f34412d7de60fa268c8cb50Affected
LinuxLinux
  • 4.11Affected
  • before 4.11Not affected
  • 6.1.162 through 6.1.*Not affected
  • 6.6.122 through 6.6.*Not affected
  • 6.12.67 through 6.12.*Not affected
  • 6.18.7 through 6.18.*Not affected
  • 6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.