Not yet scoredPublished Dec 30, 2025

CVE-2023-54240net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()

Updated under an hour ago (Oct 27, 2026, 11:30 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() rule_locs is allocated in ethtool_get_rxnfc and the size is determined by rule_cnt from user space. So rule_cnt needs to be check before using rule_locs to avoid NULL pointer dereference.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7aab747e5563ecbc9f3cb64ddea13fe7b9fee2bd before 7776591e5ae2befff86579f68916a171971c6aab; from 7aab747e5563ecbc9f3cb64ddea13fe7b9fee2bd before 751b2e22a188b0c306029d094da29b6b8de31430; from 7aab747e5563ecbc9f3cb64ddea13fe7b9fee2bd before 653fbddbdfc6673bba01b13dae5a4384ad8f92ec; from 7aab747e5563ecbc9f3cb64ddea13fe7b9fee2bd before 75f2de75c1182e80708c932418e4895dbc88b68f; from 7aab747e5563ecbc9f3cb64ddea13fe7b9fee2bd before 072324cfab9b96071c0782f51f53cc5aea1e9d5b; from 7aab747e5563ecbc9f3cb64ddea13fe7b9fee2bd before ff5faed5f5487b0fd2b640ba1304f82a5ebaab42; from 7aab747e5563ecbc9f3cb64ddea13fe7b9fee2bd before fe0195fe48f85182bc7e7eabcad925bd3cbc10f5; from 7aab747e5563ecbc9f3cb64ddea13fe7b9fee2bd before e4c79810755f66c9a933ca810da2724133b1165a	CNA record

References

References

https://git.kernel.org/stable/c/7776591e5ae2befff86579f68916a171971c6aab
https://git.kernel.org/stable/c/751b2e22a188b0c306029d094da29b6b8de31430
https://git.kernel.org/stable/c/653fbddbdfc6673bba01b13dae5a4384ad8f92ec
https://git.kernel.org/stable/c/75f2de75c1182e80708c932418e4895dbc88b68f
https://git.kernel.org/stable/c/072324cfab9b96071c0782f51f53cc5aea1e9d5b
https://git.kernel.org/stable/c/ff5faed5f5487b0fd2b640ba1304f82a5ebaab42
https://git.kernel.org/stable/c/fe0195fe48f85182bc7e7eabcad925bd3cbc10f5
https://git.kernel.org/stable/c/e4c79810755f66c9a933ca810da2724133b1165a

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.