Junglewise Threat Intelligence

CVE-2026-23084: Linux Kernel be2net NULL pointer dereference in be_cmd_get_mac_from_list

CVE-2026-23084 · Severity: medium · CVSS 5.5 · Published 2026-02-04

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel driver for Emulex be2net network interface cards. An error in how the driver handles MAC address identification can lead to a system crash (NULL pointer dereference). This could allow a local user to cause a denial-of-service condition, impacting the availability of the system and its network services.

Technical details

A NULL pointer dereference vulnerability exists in the be2net Ethernet driver within the Linux kernel. The issue occurs in the be_cmd_get_mac_from_list() function when the pmac_id_valid parameter is false and the pmac_id pointer is NULL. Under these conditions, the driver attempts to store a PMAC_ID retrieved from the firmware into the NULL address. This flaw can be triggered locally, leading to a kernel panic and denial of service. The issue has been resolved by ensuring a valid stub variable address is passed instead of NULL. Patches are available in various stable kernel branches.

Affected products

  • Linux Linux Kernel 95046b927a54 to 8215794403d264739cc676668087512950b2ff31
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-01-20: disclosed: Initial patch submitted by Andrey Vatoropin
  • 2026-01-30: patched: Patch committed to stable trees
  • 2026-02-04: advisory: CVE published

References

Related threats