CVE-2026-23117
NULL Pointer Dereference in Linux ice Driver on devlink Reload
Publication date: 2026-02-14
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.18.2 (inc) to 6.18.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ice driver, which manages certain Intel network devices. A recent code change removed a necessary call to the function ice_deinit_hw() during the device reinitialization process. Specifically, when the devlink reload operation is performed, the ice_init_hw() function fails because the hardware control queues were not properly uninitialized. This failure leads to a NULL pointer dereference when the ice driver is removed, causing a potential crash or instability.
How can this vulnerability impact me? :
The impact of this vulnerability is that performing a devlink reload on the affected ice driver can cause the initialization to fail and subsequently cause a NULL pointer dereference when the driver is removed. This can lead to system instability or crashes, potentially disrupting network connectivity or causing downtime on systems using the affected Intel network devices.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing error messages related to the ice driver in the system logs, specifically messages indicating that ice_init_hw failed with error -16 and subsequent call traces involving ice_unload and ice_remove.
You can check the system logs for these errors using commands such as:
- dmesg | grep ice
- journalctl -k | grep ice
- grep -i 'ice_init_hw failed' /var/log/syslog
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves ensuring that the ice driver is updated to a version that includes the fix where ice_deinit_hw() is properly called in the devlink reinit down path. This prevents the ice_init_hw() failure and the subsequent NULL pointer dereference.
If updating is not immediately possible, avoid performing devlink reload operations that trigger the ice driver reinitialization until the fix is applied.