CVE-2026-23054 net: hv_netvsc: reject RSS hash key programming without RX indirection table
A local attacker with high privileges can cause a system hang in the Linux kernel by programming RSS hash keys without an RX indirection table.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23054?
CVE-2026-23054 is a denial of service vulnerability in Linux, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: hv_netvsc: reject RSS hash key programming without RX indirection table
RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_filter_device_add() does not allocate an indirection table, accepting RSS hash key updates in this state leads to a hang.
Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return -EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device capabilities and prevents incorrect behavior.
Which versions are affected by CVE-2026-23054?
How do I fix CVE-2026-23054?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23054 being exploited?
There is no known exploitation of CVE-2026-23054 in the wild and no public exploit code.
Sources
Also known as AZL-77226, BELL-CVE-2026-23054, DEBIAN-CVE-2026-23054, GHSA-64h7-35x7-95w2, ROOT-OS-DEBIAN-11-CVE-2026-23054, ROOT-OS-UBUNTU-2204-CVE-2026-23054 and 2 more.