VulnerabilityPublished 4 Feb 2026Updated 10 Nov 2026

CVE-2026-23054: Linux kernel · net: hv_netvsc: reject RSS hash key programming without RX indirection table

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in d23564955811da493f34412d7de60fa268c8cb50 : update Linux kernel when convenient.

Data as of 10 Nov 2026, 13:03 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Patch: Available – fixed in d23564955811da493f34412d7de60fa268c8cb50, 8288136f508e78eb3563e7073975999cf225a2f9, 82c9039c8ebb715753a40434df714f865a3aec9c +2

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9, < d23564955811da493f34412d7de60fa268c8cb50	Fixed in d23564955811da493f34412d7de60fa268c8cb50
LinuxLinux	Affected ≥ 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9, < 8288136f508e78eb3563e7073975999cf225a2f9	Fixed in 8288136f508e78eb3563e7073975999cf225a2f9
LinuxLinux	Affected ≥ 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9, < 82c9039c8ebb715753a40434df714f865a3aec9c	Fixed in 82c9039c8ebb715753a40434df714f865a3aec9c
LinuxLinux	Affected ≥ 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9, < 11dd9a9ef4dc4507a15a69b8511a0013c6c28fa3	Fixed in 11dd9a9ef4dc4507a15a69b8511a0013c6c28fa3
LinuxLinux	Affected ≥ 962f3fee83a4ef9010ae84dc43ae7aecb572e2a9, < 4cd55c609e85ae2313248ef1a33619a3eef44a16	Fixed in 4cd55c609e85ae2313248ef1a33619a3eef44a16
LinuxLinux	Affected =4.11	Fixed in–

AI-suggested

A fix is available and has been applied in the Linux kernel. Users should update to a fixed kernel version that includes the patches identified by the commit hashes d23564955811da493f34412d7de60fa268c8cb50, 8288136f508e78eb3563e7073975999cf225a2f9, 82c9039c8ebb715753a40434df714f865a3aec9c, 11dd9a9ef4dc4507a15a69b8511a0013c6c28fa3, and 4cd55c609e85ae2313248ef1a33619a3eef44a16. No additional mitigation steps are indicated.

Description

A vulnerability in the Linux kernel's hv_netvsc driver allows programming of the RSS hash key without a valid RX indirection table, which can cause the device to hang. This occurs when the device reports a single receive queue and does not allocate an indirection table, but still accepts RSS hash key updates. The issue is fixed by ensuring that RSS hash key programming is only allowed when a valid RX indirection table is present.

Impact

If exploited, this vulnerability can cause the affected Linux system to hang due to improper handling of RSS hash key programming without a valid RX indirection table. This impacts system stability and reliability but does not indicate privilege escalation or data compromise.

Summary

The Linux kernel hv_netvsc driver had a flaw where it accepted RSS hash key programming even when the RX indirection table was not allocated, specifically when the device reported a single receive queue. This mismatch could lead to a system hang. The fix involves gating the netvsc_set_rxfh() function on the presence of the RX indirection table size (ndc->rx_table_sz) and returning an error (-EOPNOTSUPP) if the table is absent, aligning the behavior with device capabilities and preventing the hang.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Nov 2026, 13:03 UTC

Technical details

References

Community reviews

Related threats