Executive brief
A vulnerability was identified in the Linux kernel's Intel 'ice' network driver. A race condition during the cleanup of network transmission timestamps could cause the system to crash (NULL pointer dereference). This primarily impacts system stability and availability for servers using affected Intel network hardware.
Technical details
A race condition exists between ice_free_tx_tstamp_ring() and ice_tx_map() in the Intel 'ice' driver. The root cause is the improper ordering of clearing the ICE_TX_FLAGS_TXTIME flag and NULLing the tstamp_ring pointer. If ice_tx_map() executes on a concurrent CPU, it may see the flag as set but find the pointer already NULL, leading to a NULL pointer dereference. The fix involves reordering these operations using memory barriers (smp_wmb/smp_rmb), utilizing READ_ONCE(), and converting flag operations to atomic bitops. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel 6.18, 7.0.10, 7.1
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory