CVE-2026-23020

What it actually does

Null pointer dereference in vortex_probe1() when pdev is null, allowing free_ring to be invoked with a null argument and resulting in a kernel crash.

Why it matters to the business

Low-likelihood local denial-of-service risk that can destabilize systems running the affected driver code; limited downstream impact given low EPSS and no known exploitation.

How an attack unfolds

A local attacker triggers the 3c59x vortex_probe1 path with a crafted or missing pdev structure, causing the null dereference inside free_ring during device initialization.

How to fix it

Update wazuh/wazuh to commit 2f1a131a853542c02930f31404fbe801d353fdc4 or later; rebuild and redeploy any affected kernel modules or packages containing the 3c59x driver.

How to confirm the fix worked

Confirm the fix by verifying the presence of the commit 2f1a131a853542c02930f31404fbe801d353fdc4 in the source tree and testing that vortex_probe1 no longer passes null to free_ring.

Typical attack path

1. Obtain local access to a system using the vulnerable 3com 3c59x driver
2. Force or wait for vortex_probe1 execution with a null pdev pointer
3. Trigger free_ring call that dereferences the null pointer
4. Cause kernel panic or system hang

How to detect it

Review kernel logs for null pointer dereference oops messages referencing vortex_probe1 or free_ring; inspect device probe paths during 3c59x initialization for abnormal failures.

What your security team should do

• Apply the referenced commit immediately on any systems shipping the 3c59x driver code
• Monitor for local privilege-escalation or crash reports involving 3com network devices
• Review kernel configuration to disable unused legacy 3c59x drivers where possible