CVE-2026-22993

CVE-2026-22993 is a NULL pointer dereference vulnerability in the idpf driver of the Linux kernel. It occurs when an ethtool command attempts to access the Receive Side Scaling (RSS) Lookup Table (LUT) immediately after a soft reset, but before the LUT is properly restored, leading to a kernel crash. This affects Linux kernel versions utilizing the idpf driver. Rated with a CVSS score of 5.5 (Medium), the vulnerability has a local attack vector and low attack complexity, requiring local user privileges. A successful exploit could lead to a denial of service (system crash), but not directly to confidentiality or integrity compromises. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and limited media coverage, primarily through a security update from openSUSE.