CVE-2026-23084

A NULL pointer dereference vulnerability was found in the Linux kernel's be2net driver for Emulex BladeEngine network adapters. The be_cmd_get_mac_from_list() function is called with pmac_id_valid set to false and pmac_id set to NULL, violating the function's contract. When the function attempts to store the PMAC_ID retrieved from firmware at the NULL address, a kernel crash occurs.

This vulnerability affects systems with Emulex BladeEngine network adapters during MAC address retrieval operations. The crash occurs during normal driver operation, not requiring any special attacker action. Impact is limited to denial of service through kernel panic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the be2net module from being loaded if Emulex BladeEngine network adapters are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.