CVE-2026-23210
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In the Linux kernel, the ice driver (Intel E800 NIC) has a race condition during VSI rebuild. PTP periodic work is queued before the VSI rebuild completes, causing a NULL pointer dereference on vsi->rx_rings and a kernel oops.
Risk Assessment
This can cause a kernel crash (oops) and make the network adapter unavailable, leading to loss of network connectivity and potential service disruption on the server.
Recommendation
Update the Linux kernel to a version containing the fix (commit addressing CVE-2026-23210) or apply the appropriate patch for the ice driver.
Other vulnerabilities in Linux kernel ice driver
See all- CVE-2026-98965Unknown
In the Linux kernel, a bug was fixed in the ice driver where using writel_relaxed() for Tx doorbell updates did not provide proper write ordering on arm64. This introduced a race where the NIC could start transmitting before the dql->num_queued update was visible, triggering BUG_ON in dql_completed() and a kernel crash.
- CVE-2023-53102High
In the Linux kernel, a bug was found in the ice driver (Intel NIC) where the txq IRQ is disabled only after flushing the hardware, rendering the flush ineffective. This allows NAPI to run while the xsk_pool pointer is still valid but the software ring of xdp_buff pointers has already been freed, causing a NULL pointer dereference and kernel panic.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ice: Fix PTP NULL pointer dereference during VSI rebuild Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings. The sequence was: 1. ice_ptp_prepare_for_reset() cancels PTP work 2. ice_ptp_rebuild() immediately queues PTP work 3. VSI rebuild happens AFTER ice_ptp_rebuild() 4. PTP work runs and accesses NULL vsi->rx_rings Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild(). Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY. Error log: [ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: error_code(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=CPU_OUT_OF_SPEC [ 121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] <TASK> [ 121.393055] ice_ptp_periodic_work+0x69/0x180 [ice] [ 121.393202] kthread_worker_fn+0xa2/0x260 [ 121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice] [ 121.393359] ? __pfx_kthread_worker_fn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? __pfx_kthread+0x10/0x10 [ 121.393393] ret_from_fork+0x273/0x2b0 [ 121.393407] ? __pfx_kthread+0x10/0x10 [ 121.393417] ret_from_fork_asm+0x1a/0x30 [ 121.393432] </TASK>
Vulnerability data from NVD (NIST) · CISA KEV · EPSS