In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
The driver allocates arrays for ports, FDBs, and filter blocks using
kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the
device reports zero interfaces (either due to hardware configuration
or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10)
instead of NULL.
Later in dpaa2_switch_probe(), the NAPI initialization unconditionally
accesses ethsw->ports[0]->netdev, which attempts to dereference
ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic.
Add a check to ensure num_ifs is greater than zero after retrieving
device attributes. This prevents the zero-sized allocations and
subsequent invalid pointer dereference.
Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-23206",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"dateUpdated": "2026-02-14T16:27:29.095Z",
"dateReserved": "2026-01-13T15:37:45.986Z",
"datePublished": "2026-02-14T16:27:29.095Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-02-14T16:27:29.095Z"
},
"title": "dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero\n\nThe driver allocates arrays for ports, FDBs, and filter blocks using\nkcalloc() with ethsw->sw_attr.num_ifs as the element count. When the\ndevice reports zero interfaces (either due to hardware configuration\nor firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10)\ninstead of NULL.\n\nLater in dpaa2_switch_probe(), the NAPI initialization unconditionally\naccesses ethsw->ports[0]->netdev, which attempts to dereference\nZERO_SIZE_PTR (address 0x10), resulting in a kernel panic.\n\nAdd a check to ensure num_ifs is greater than zero after retrieving\ndevice attributes. This prevents the zero-sized allocations and\nsubsequent invalid pointer dereference."
}
],
"affected": [
{
"vendor": "Linux",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0b1b71370458860579831e77485883fcf2e8fbbe",
"status": "affected",
"versionType": "git",
"lessThan": "2fcccca88456b592bd668db13aa1d29ed257ca2b"
},
{
"version": "0b1b71370458860579831e77485883fcf2e8fbbe",
"status": "affected",
"versionType": "git",
"lessThan": "80165ff16051448d6f840585ebe13f2400415df3"
},
{
"version": "0b1b71370458860579831e77485883fcf2e8fbbe",
"status": "affected",
"versionType": "git",
"lessThan": "b97415c4362f739e25ec6f71012277086fabdf6f"
},
{
"version": "0b1b71370458860579831e77485883fcf2e8fbbe",
"status": "affected",
"versionType": "git",
"lessThan": "4acc40db06ffd0fd92683505342b00c8a7394c60"
},
{
"version": "0b1b71370458860579831e77485883fcf2e8fbbe",
"status": "affected",
"versionType": "git",
"lessThan": "155eb99aff2920153bf21217ae29565fff81e6af"
},
{
"version": "0b1b71370458860579831e77485883fcf2e8fbbe",
"status": "affected",
"versionType": "git",
"lessThan": "ed48a84a72fefb20a82dd90a7caa7807e90c6f66"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"defaultStatus": "affected",
"versions": [
{
"version": "5.13",
"status": "affected"
},
{
"version": "0",
"status": "unaffected",
"versionType": "semver",
"lessThan": "5.13"
},
{
"version": "5.15.200",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"version": "6.1.163",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"version": "6.6.124",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"version": "6.12.70",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"version": "6.18.10",
"status": "unaffected",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"version": "6.19",
"status": "unaffected",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/2fcccca88456b592bd668db13aa1d29ed257ca2b"
},
{
"url": "https://git.kernel.org/stable/c/80165ff16051448d6f840585ebe13f2400415df3"
},
{
"url": "https://git.kernel.org/stable/c/b97415c4362f739e25ec6f71012277086fabdf6f"
},
{
"url": "https://git.kernel.org/stable/c/4acc40db06ffd0fd92683505342b00c8a7394c60"
},
{
"url": "https://git.kernel.org/stable/c/155eb99aff2920153bf21217ae29565fff81e6af"
},
{
"url": "https://git.kernel.org/stable/c/ed48a84a72fefb20a82dd90a7caa7807e90c6f66"
}
]
}
}
}