Executive brief
A vulnerability in the Linux kernel's Intel igc network driver could cause a complete system crash (kernel panic). This occurs when the system attempts to initialize the network card's status LEDs and encounters an error, leading to improper memory handling. While the issue primarily affects system stability, it could potentially be used to disrupt operations or gain further unauthorized access on a local system.
Technical details
A vulnerability in the Linux kernel igc driver (Intel i225/i226 Ethernet) arises from improper error handling in the igc_probe() function. When igc_led_setup() fails (e.g., due to memory allocation failure during fault injection), the probe function terminates and calls free_netdev() without first calling unregister_netdev(). This violates kernel networking invariants and triggers a kernel BUG/panic. The fix involves treating LED initialization failures as non-fatal, allowing the driver to continue loading without LED support. Patches have been released for multiple stable branches including 6.12.y and 6.16.y.
Affected products
- Linux Linux Kernel 6.9 to 6.12.49, 6.13 to 6.16.9, 6.17-rc1 to 6.17-rc6
Timeline
- 2025-09-10: patched: Initial patch authored
- 2025-10-09: disclosed: CVE published