Answer in brief
CVE-2026-23206 records a Unknown severity vulnerability in dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0b1b71370458860579831e77485883fcf2e8fbbe <2fcccca88456b592bd668db13aa1d29ed257ca2b || >=0b1b71370458860579831e77485883fcf2e8fbbe <80165ff16051448d6f840585ebe13f2400415df3 || >=0b1b71370458860579831e77485883fcf2e8fbbe <b97415c4362f739e25ec6f71012277086fabdf6f || >=0b1b71370458860579831e77485883fcf2e8fbbe <4acc40db06ffd0fd92683505342b00c8a7394c60 || >=0b1b71370458860579831e77485883fcf2e8fbbe <155eb99aff2920153bf21217ae29565fff81e6af || >=0b1b71370458860579831e77485883fcf2e8fbbe <ed48a84a72fefb20a82dd90a7caa7807e90c6f66 | 2fcccca88456b592bd668db13aa1d29ed257ca2b, 80165ff16051448d6f840585ebe13f2400415df3, b97415c4362f739e25ec6f71012277086fabdf6f, 4acc40db06ffd0fd92683505342b00c8a7394c60, 155eb99aff2920153bf21217ae29565fff81e6af, ed48a84a72fefb20a82dd90a7caa7807e90c6f66 |
| Linux/Linuxgeneric | 5.13 | Not reported |
Published upstream
Feb 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 5, 2026
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero The driver allocates arrays for ports, FDBs, and filter blocks using kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the device reports zero interfaces (either due to hardware configuration or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10) instead of NULL. Later in dpaa2_switch_probe(), the NAPI initialization unconditionally accesses ethsw->ports[0]->netdev, which attempts to dereference ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic. Add a check to ensure num_ifs is greater than zero after retrieving device attributes. This prevents the zero-sized allocations and subsequent invalid pointer dereference.
Quoted source text, attributed separately from HOL analysis.