CVE-2026-23445
Received Received - Intake
Use-After-Free in Linux igc Driver Causes Kernel Page Fault

Publication date: 2026-04-03

Last updated on: 2026-04-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: igc: fix page fault in XDP TX timestamps handling If an XDP application that requested TX timestamping is shutting down while the link of the interface in use is still up the following kernel splat is reported: [ 883.803618] [ T1554] BUG: unable to handle page fault for address: ffffcfb6200fd008 ... [ 883.803650] [ T1554] Call Trace: [ 883.803652] [ T1554] <TASK> [ 883.803654] [ T1554] igc_ptp_tx_tstamp_event+0xdf/0x160 [igc] [ 883.803660] [ T1554] igc_tsync_interrupt+0x2d5/0x300 [igc] ... During shutdown of the TX ring the xsk_meta pointers are left behind, so that the IRQ handler is trying to touch them. This issue is now being fixed by cleaning up the stale xsk meta data on TX shutdown. TX timestamps on other queues remain unaffected.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-03
Last Modified
2026-04-27
Generated
2026-06-16
AI Q&A
2026-04-03
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23445
EUVD
EUVD-2026-18690
Affected Vendors & Products
Showing 11 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.10
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.13 (inc) to 6.18.20 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.10 (exc)
linux linux_kernel From 6.10.1 (inc) to 6.12.78 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

This vulnerability can be detected by monitoring the system logs for kernel splats related to the igc driver when an XDP application using TX timestamping is shutting down. Specifically, look for messages indicating a page fault in the igc_ptp_tx_tstamp_event or igc_tsync_interrupt functions.

  • Check kernel logs for error messages similar to: "BUG: unable to handle page fault for address" followed by a call trace involving igc_ptp_tx_tstamp_event and igc_tsync_interrupt.
  • Use the command: dmesg | grep -i 'igc_ptp_tx_tstamp_event' to filter relevant kernel messages.
  • Alternatively, monitor system logs with: journalctl -k | grep -i 'igc_ptp_tx_tstamp_event'
Executive Summary

This vulnerability exists in the Linux kernel's igc driver related to handling TX timestamps in XDP (Express Data Path) applications.

When an XDP application that requested TX timestamping shuts down while the network interface link is still active, a kernel page fault occurs. This happens because during the shutdown of the TX ring, some xsk_meta pointers are not properly cleaned up, causing the IRQ handler to access invalid memory.

The issue leads to a kernel crash (kernel splat) due to the page fault. The vulnerability is fixed by cleaning up the stale xsk meta data on TX shutdown, ensuring that TX timestamps on other queues are not affected.

Impact Analysis

This vulnerability can cause the Linux kernel to crash (kernel splat) when an XDP application using TX timestamping shuts down improperly while the network interface is still active.

Such a crash can lead to system instability, potential downtime, and disruption of network services relying on the affected interface.

Mitigation Strategies

To mitigate this vulnerability, ensure that the Linux kernel is updated to a version where the fix for cleaning up stale xsk meta data on TX shutdown is applied.

Until the kernel is updated, avoid shutting down XDP applications that request TX timestamping while the network interface link is still up, as this triggers the kernel splat.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23445. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart