Executive brief
A vulnerability was identified in the Linux kernel's Intel Ethernet (ice) driver that could cause a system crash. The issue occurs when the system fails to properly configure network ring parameters, leading to a memory error known as a NULL pointer dereference. This could result in a denial-of-service condition, impacting the availability of the affected system.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel 'ice' driver within the ice_set_ringparam() function. The root cause is that the function nullifies the tstamp_ring of temporary tx_rings without clearing the ICE_TX_RING_FLAGS_TXTIME bit. If a subsequent call to ice_setup_tx_ring() fails, the unwinding sequence in ice_clean_tx_ring() attempts to access the nullified tstamp_ring because the TXTIME flag is still set. This issue specifically affects Intel E830 devices using Earliest TxTime First Offload. An attacker with sufficient local privileges to modify network interface parameters could trigger this crash. The issue has been resolved by ensuring the ICE_TX_RING_FLAGS_TXTIME bit is cleared during the configuration process.
Affected products
- Linux Linux 6.18, 7.0.10
Timeline
- 2026-04-16: disclosed: Vulnerability identified via manual code review
- 2026-06-24: advisory: CVE-2026-53007 published
- 2026-05-23: patched: Fix committed to stable tree