Junglewise Threat Intelligence

CVE-2026-23054: Linux Kernel hv_netvsc denial of service via RSS configuration hang

CVE-2026-23054 · Severity: info · CVSS 0 · Published 2026-02-04

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's Hyper-V network driver can cause a system hang when configuring network settings on devices with only one receive queue. This affects systems running Linux on Microsoft Hyper-V, including certain industrial Siemens controllers. An exploit could lead to a complete denial of service, requiring a system reboot to restore operations.

Technical details

A vulnerability exists in the Linux kernel's hv_netvsc driver (drivers/net/hyperv/netvsc_drv.c) due to improper validation of Receive Side Scaling (RSS) configurations. When a device reports only a single receive queue, the driver fails to allocate an RX indirection table; however, the netvsc_set_rxfh() function still accepts RSS hash key updates, leading to a kernel hang. The issue is triggered via ethtool operations to set RSS settings. The fix involves gating netvsc_set_rxfh() to return -EOPNOTSUPP if the indirection table size is zero. Patches have been backported to various stable kernel branches including 6.1.y, 6.6.y, 6.12.y, and 6.18.y.

Affected products

  • Linux Linux Kernel 4.11 to 6.18.7
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-02-04: advisory: Initial NVD publication
  • 2026-01-23: patched: Patched in various Linux stable branches
  • 2026-07-14: advisory: Siemens industrial products confirmed affected

References

Related threats