CVE-2026-23117
Description
A flaw was found in the Linux kernel's Intel ice network driver. When performing a devlink-reload operation, the ice_devlink_reinit_down() function fails to call ice_deinit_hw() to properly uninitialize the hardware control queues. This causes the subsequent ice_init_hw() call to fail with -EBUSY. If the driver is then removed, a NULL pointer dereference occurs in ice_unload(), leading to a kernel crash.
Statement
Triggering this flaw requires administrator privileges to perform devlink-reload operations, followed by driver removal. The vulnerability is specific to the ice driver used with Intel Ethernet 800 Series adapters and requires a specific sequence of administrative operations. The kernel crash can occur in the Intel ice driver when using the devlink reload workflow. A prior change removed a deinitialization call from a shared deinit helper. As a consequence the devlink reinit down path no longer deinitialized the hardware control queues via ice_deinit_hw. The devlink reinit up path still calls ice_init_hw. With control queues left initialized the subsequent init can fail with -EBUSY. After this inconsistent state a later device removal or module unload can hit a NULL pointer dereference in the ice unload remove path, resulting in a local denial of service. Triggering conditions require local access capable of invoking devlink reload operations, which typically maps to administrative privileges such as CAP_NET_ADMIN.
Mitigation
To mitigate this issue, prevent the ice module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist kernel modules.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.
Integrity,Confidentiality
Technical Impact: Execute Unauthorized Code or Commands; Read Memory; Modify Memory
In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
