CVE-2026-23210
NULL Pointer Dereference in Linux ice Driver PTP VSI Rebuild
Publication date: 2026-02-14
Last updated on: 2026-04-02
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.9 (inc) to 6.18.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ice driver, specifically related to the Precision Time Protocol (PTP) functionality during a VSI (Virtual Station Interface) rebuild.
A race condition occurs where PTP periodic work runs while the VSI is being rebuilt, causing the code to access a NULL pointer (vsi->rx_rings). This happens because the PTP work is queued immediately after ice_ptp_rebuild() but before the VSI rebuild completes, leading to a NULL pointer dereference and a kernel crash.
The fix involves keeping the PTP work cancelled during the VSI rebuild and only queuing it after the rebuild completes, preventing the NULL pointer access.
How can this vulnerability impact me? :
This vulnerability can cause a kernel NULL pointer dereference, leading to a kernel crash (Oops) and potentially causing system instability or denial of service.
If exploited or triggered, it could disrupt network time synchronization services relying on PTP, affecting time-sensitive applications or systems.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system kernel logs for specific error messages related to the ice driver and PTP NULL pointer dereference.
- Look for error logs similar to: "BUG: kernel NULL pointer dereference, address: 0000000000000000" and "ice 0000:60:00.1: PTP reset successful".
- Check kernel logs using the command: dmesg | grep -i 'ice\|PTP\|NULL pointer dereference'
- Alternatively, monitor /var/log/kern.log or /var/log/messages for these error patterns.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the ice driver has the fix applied.
The fix involves keeping PTP work cancelled during VSI rebuild and only queuing it after the rebuild completes, preventing the NULL pointer dereference.
If updating the kernel immediately is not possible, monitor for the error logs and consider temporarily disabling PTP support on affected devices to avoid triggering the race condition.