Executive brief
The Intel Gigabit Controller (igc) network driver in the Linux kernel could trigger a kernel panic when transmit queue timeouts occur during network operations. This results in system crashes that can disrupt network services and cause unplanned downtime. The vulnerability affects systems using Intel 10/100/1000 Mbps Ethernet network cards, particularly in high-load scenarios.
Technical details
The vulnerability is a race condition in the igc driver's transmit timeout handling mechanism (ndo_tx_timeout callback). When igc_tx_timeout() is invoked due to a transmit queue timeout, a race condition can occur between the timeout handler and igc_clean_tx_irq() if the interface is being reset while IRQ processing occurs. The root cause stems from TX ring hardware queues not being properly disabled during the igc_down() phase, allowing interrupt handlers to access ring structures being torn down. An attacker with local network access or ability to generate sustained transmit traffic can trigger this race condition. The fix involves disabling all TX ring HW queues during the igc_down() reset process and re-enabling them during igc_up(), eliminating the window for the race condition.
Affected products
- Linux kernel affected versions prior to CVE-2023-54166 fix
Timeline
- 2025-12-30: disclosed: Vulnerability disclosed with kernel trace and fix details