Executive brief
A vulnerability in the Linux kernel's Intel i40e network driver could allow a local user to cause system instability or a denial of service. The issue stems from a technical error in how the system tracks processor tasks during network monitoring, leading to a 'preempt count leak.' Over time, this can degrade system performance or cause the operating system to crash.
Technical details
A vulnerability exists in the i40e network driver within the Linux kernel due to an improper implementation of the i40e_napi_poll tracepoint. The code used the get_cpu() function, which increments the preemption count to disable preemption, but failed to call the corresponding put_cpu() to decrement it. This results in a preempt count leak every time the tracepoint is triggered. An attacker with local access could potentially exploit this to cause a kernel panic or system hang (Denial of Service). The fix replaces get_cpu() with smp_processor_id(), which retrieves the processor ID without affecting the preemption count.
Affected products
- Linux Linux Kernel 6.2 to 6.6.136, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1, 7.0-rc2
Timeline
- 2026-03-25: disclosed
- 2026-03-25: advisory
- 2026-02-07: patched: Initial patch authored by Thomas Gleixner
References
- https://git.kernel.org/stable/c/4b3d54a85bd37ebf2d9836f0d0de775c0ff21af9
- https://git.kernel.org/stable/c/9e0f091821571f0da387462803ee42f0bb157582
- https://git.kernel.org/stable/c/b7e91827e1cf89cd34ad11dc8f8c010b70ab786e
- https://git.kernel.org/stable/c/dca4ea596a3b0a1b82bc1d9f3e4d88bd9ad9561f
- https://git.kernel.org/stable/c/fa5d5baf67f619c7aa70697a194b5a9edd9f5bb7