CVE-2026-23084 be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list

What is CVE-2026-23084?

CVE-2026-23084 is a medium-severity vulnerability in Linux kernel, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list

When the parameter pmac_id_valid argument of be_cmd_get_mac_from_list() is set to false, the driver may request the PMAC_ID from the firmware of the network card, and this function will store that PMAC_ID at the provided address pmac_id. This is the contract of this function.

However, there is a location within the driver where both pmac_id_valid == false and pmac_id == NULL are being passed. This could result in dereferencing a NULL pointer.

To resolve this issue, it is necessary to pass the address of a stub variable to the function.

Weakness: CWE-476

Which versions are affected by CVE-2026-23084?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-23084?

Apply the vendor's patch.

Is CVE-2026-23084 being exploited?

There is no known exploitation of CVE-2026-23084 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-77259, BELL-CVE-2026-23084, DEBIAN-CVE-2026-23084, GHSA-2j82-cf92-x9qh, ROOT-OS-DEBIAN-11-CVE-2026-23084, ROOT-OS-DEBIAN-12-CVE-2026-23084 and 4 more.