CVE-2026-23206

dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero

State
Published
Severity
Not scored
Published
Feb 14, 2026
Updated
May 11, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero

The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the device reports zero interfaces (either due to hardware configuration or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10) instead of NULL.

Later in dpaa2_switch_probe(), the NAPI initialization unconditionally accesses ethsw->ports[0]->netdev, which attempts to dereference ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic.

Add a check to ensure num_ifs is greater than zero after retrieving device attributes. This prevents the zero-sized allocations and subsequent invalid pointer dereference.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0b1b71370458860579831e77485883fcf2e8fbbe to before 2fcccca88456b592bd668db13aa1d29ed257ca2bAffected
  • 0b1b71370458860579831e77485883fcf2e8fbbe to before 80165ff16051448d6f840585ebe13f2400415df3Affected
  • 0b1b71370458860579831e77485883fcf2e8fbbe to before b97415c4362f739e25ec6f71012277086fabdf6fAffected
  • 0b1b71370458860579831e77485883fcf2e8fbbe to before 4acc40db06ffd0fd92683505342b00c8a7394c60Affected
  • 0b1b71370458860579831e77485883fcf2e8fbbe to before 155eb99aff2920153bf21217ae29565fff81e6afAffected
  • 0b1b71370458860579831e77485883fcf2e8fbbe to before ed48a84a72fefb20a82dd90a7caa7807e90c6f66Affected
LinuxLinux
  • 5.13Affected
  • before 5.13Not affected
  • 5.15.200 through 5.15.*Not affected
  • 6.1.163 through 6.1.*Not affected
  • 6.6.124 through 6.6.*Not affected
  • 6.12.70 through 6.12.*Not affected
  • 6.18.10 through 6.18.*Not affected
  • 6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.