Executive brief
A vulnerability exists in the Linux kernel's Intel Ethernet Connection (ice) driver. Under certain conditions involving Link Aggregation (LAG) configurations, the system may attempt to access memory that does not exist, leading to a system crash. This could result in a denial-of-service, impacting the availability of the affected server or network device.
Technical details
A NULL pointer dereference vulnerability exists in the ice driver (drivers/net/ethernet/intel/ice/ice_lag.c) within the ice_lag_is_switchdev_running() function. The issue occurs because the function is called from contexts outside the LAG event handler, where the 'upper_netdev' pointer may not be initialized. An attacker or specific network conditions could trigger this dereference, leading to a kernel oops and system instability. Patches have been released for multiple stable kernel branches including 6.6.y, 6.12.y, and 6.15.y.
Affected products
- Linux Linux Kernel 6.6 to 6.6.100, 6.7 to 6.12.40, 6.13 to 6.15.8
Timeline
- 2025-08-16: advisory: Initial disclosure of CVE-2025-38526
- 2025-07-24: patched: Fixes merged into various stable kernel branches