Linux kernel ice driver vulnerabilities

In the Linux kernel, a bug was fixed in the ice driver where using writel_relaxed() for Tx doorbell updates did not provide proper write ordering on arm64. This introduced a race where the NIC could start transmitting before the dql->num_queued update was visible, triggering BUG_ON in dql_completed() and a kernel crash.

In the Linux kernel, the ice driver (Intel E800 NIC) has a race condition during VSI rebuild. PTP periodic work is queued before the VSI rebuild completes, causing a NULL pointer dereference on vsi->rx_rings and a kernel oops.

In the Linux kernel, a bug was found in the ice driver (Intel NIC) where the txq IRQ is disabled only after flushing the hardware, rendering the flush ineffective. This allows NAPI to run while the xsk_pool pointer is still valid but the software ring of xdp_buff pointers has already been freed, causing a NULL pointer dereference and kernel panic.