CVE-2026-23353
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A bug was fixed in the Linux kernel's ice driver that caused a crash (NULL pointer dereference) during the ethtool offline loopback test. The crash occurred because libeth was not initialized for the rx ring in loopback VSIs. The fix treats ICE_VSI_LB VSIs more like normal PF VSIs by giving them a dummy q_vector, allowing the napi struct to be passed to libeth_rx_fq_create().
Risk Assessment
A kernel crash during the ethtool test can lead to network interface or system unavailability (kernel panic), posing a risk to network service continuity. The issue only occurs when an administrator or diagnostic tool runs the loopback test on an ice network card.
Recommendation
Update the Linux kernel to a version that includes the fix for CVE-2026-23353. Until then, avoid running ethtool offline loopback tests on ice network cards.
Other vulnerabilities in Linux kernel ice driver
See all- CVE-2026-98965High
In the Linux kernel, a bug was fixed in the ice driver where using writel_relaxed() for Tx doorbell updates did not provide proper write ordering on arm64. This introduced a race where the NIC could start transmitting before the dql->num_queued update was visible, triggering BUG_ON in dql_completed() and a kernel crash.
- CVE-2026-23210Medium
In the Linux kernel, the ice driver (Intel E800 NIC) has a race condition during VSI rebuild. PTP periodic work is queued before the VSI rebuild completes, causing a NULL pointer dereference on vsi->rx_rings and a kernel oops.
- CVE-2023-53102High
In the Linux kernel, a bug was found in the ice driver (Intel NIC) where the txq IRQ is disabled only after flushing the hardware, rendering the flush ineffective. This allows NAPI to run while the xsk_pool pointer is still valid but the software ring of xdp_buff pointers has already been freed, causing a NULL pointer dereference and kernel panic.
- CVE-2024-46765High
In the Linux kernel, the ice driver (Intel network card) has a synchronization issue between XDP configuration and PF reset. Lack of a mutex protecting ice_xdp() and ice_vsi_rebuild() can lead to a race condition and a kernel crash (NULL pointer dereference). The vulnerability is fixed by adding the xdp_state_lock mutex and a VSI state flag.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ice: fix crash in ethtool offline loopback test Since the conversion of ice to page pool, the ethtool loopback test crashes: BUG: kernel NULL pointer dereference, address: 000000000000000c #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 1100f1067 P4D 0 Oops: Oops: 0002 [#1] SMP NOPTI CPU: 23 UID: 0 PID: 5904 Comm: ethtool Kdump: loaded Not tainted 6.19.0-0.rc7.260128g1f97d9dcf5364.49.eln154.x86_64 #1 PREEMPT(lazy) Hardware name: [...] RIP: 0010:ice_alloc_rx_bufs+0x1cd/0x310 [ice] Code: 83 6c 24 30 01 66 41 89 47 08 0f 84 c0 00 00 00 41 0f b7 dc 48 8b 44 24 18 48 c1 e3 04 41 bb 00 10 00 00 48 8d 2c 18 8b 04 24 <89> 45 0c 41 8b 4d 00 49 d3 e3 44 3b 5c 24 24 0f 83 ac fe ff ff 44 RSP: 0018:ff7894738aa1f768 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000700 RDI: 0000000000000000 RBP: 0000000000000000 R08: ff16dcae79880200 R09: 0000000000000019 R10: 0000000000000001 R11: 0000000000001000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ff16dcae6c670000 FS: 00007fcf428850c0(0000) GS:ff16dcb149710000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000c CR3: 0000000121227005 CR4: 0000000000773ef0 PKRU: 55555554 Call Trace: <TASK> ice_vsi_cfg_rxq+0xca/0x460 [ice] ice_vsi_cfg_rxqs+0x54/0x70 [ice] ice_loopback_test+0xa9/0x520 [ice] ice_self_test+0x1b9/0x280 [ice] ethtool_self_test+0xe5/0x200 __dev_ethtool+0x1106/0x1a90 dev_ethtool+0xbe/0x1a0 dev_ioctl+0x258/0x4c0 sock_do_ioctl+0xe3/0x130 __x64_sys_ioctl+0xb9/0x100 do_syscall_64+0x7c/0x700 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] It crashes because we have not initialized libeth for the rx ring. Fix it by treating ICE_VSI_LB VSIs slightly more like normal PF VSIs and letting them have a q_vector. It's just a dummy, because the loopback test does not use interrupts, but it contains a napi struct that can be passed to libeth_rx_fq_create() called from ice_vsi_cfg_rxq() -> ice_rxq_pp_create().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS