CVE-2026-23210 (GCVE-0-2026-23210)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-02-14 16:27
VLAI?
Title
ice: Fix PTP NULL pointer dereference during VSI rebuild
Summary
In the Linux kernel, the following vulnerability has been resolved: ice: Fix PTP NULL pointer dereference during VSI rebuild Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings. The sequence was: 1. ice_ptp_prepare_for_reset() cancels PTP work 2. ice_ptp_rebuild() immediately queues PTP work 3. VSI rebuild happens AFTER ice_ptp_rebuild() 4. PTP work runs and accesses NULL vsi->rx_rings Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild(). Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY. Error log: [ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: error_code(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=CPU_OUT_OF_SPEC [ 121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] <TASK> [ 121.393055] ice_ptp_periodic_work+0x69/0x180 [ice] [ 121.393202] kthread_worker_fn+0xa2/0x260 [ 121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice] [ 121.393359] ? __pfx_kthread_worker_fn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? __pfx_kthread+0x10/0x10 [ 121.393393] ret_from_fork+0x273/0x2b0 [ 121.393407] ? __pfx_kthread+0x10/0x10 [ 121.393417] ret_from_fork_asm+0x1a/0x30 [ 121.393432] </TASK>
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 803bef817807d2d36c930dada20c96fffae0dd19 , < 7565d4df66b6619b50dc36618d8b8f1787d77e19 (git)
Affected: 803bef817807d2d36c930dada20c96fffae0dd19 , < fc6f36eaaedcf4b81af6fe1a568f018ffd530660 (git)
Create a notification for this product.
    Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.18.10 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_main.c",
            "drivers/net/ethernet/intel/ice/ice_ptp.c",
            "drivers/net/ethernet/intel/ice/ice_ptp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7565d4df66b6619b50dc36618d8b8f1787d77e19",
              "status": "affected",
              "version": "803bef817807d2d36c930dada20c96fffae0dd19",
              "versionType": "git"
            },
            {
              "lessThan": "fc6f36eaaedcf4b81af6fe1a568f018ffd530660",
              "status": "affected",
              "version": "803bef817807d2d36c930dada20c96fffae0dd19",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_main.c",
            "drivers/net/ethernet/intel/ice/ice_ptp.c",
            "drivers/net/ethernet/intel/ice/ice_ptp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix PTP NULL pointer dereference during VSI rebuild\n\nFix race condition where PTP periodic work runs while VSI is being\nrebuilt, accessing NULL vsi-\u003erx_rings.\n\nThe sequence was:\n1. ice_ptp_prepare_for_reset() cancels PTP work\n2. ice_ptp_rebuild() immediately queues PTP work\n3. VSI rebuild happens AFTER ice_ptp_rebuild()\n4. PTP work runs and accesses NULL vsi-\u003erx_rings\n\nFix: Keep PTP work cancelled during rebuild, only queue it after\nVSI rebuild completes in ice_rebuild().\n\nAdded ice_ptp_queue_work() helper function to encapsulate the logic\nfor queuing PTP work, ensuring it\u0027s only queued when PTP is supported\nand the state is ICE_PTP_READY.\n\nError log:\n[  121.392544] ice 0000:60:00.1: PTP reset successful\n[  121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[  121.392712] #PF: supervisor read access in kernel mode\n[  121.392720] #PF: error_code(0x0000) - not-present page\n[  121.392727] PGD 0\n[  121.392734] Oops: Oops: 0000 [#1] SMP NOPTI\n[  121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S                  6.19.0-rc6+ #4 PREEMPT(voluntary)\n[  121.392761] Tainted: [S]=CPU_OUT_OF_SPEC\n[  121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice]\n[  121.393042] Call Trace:\n[  121.393047]  \u003cTASK\u003e\n[  121.393055]  ice_ptp_periodic_work+0x69/0x180 [ice]\n[  121.393202]  kthread_worker_fn+0xa2/0x260\n[  121.393216]  ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice]\n[  121.393359]  ? __pfx_kthread_worker_fn+0x10/0x10\n[  121.393371]  kthread+0x10d/0x230\n[  121.393382]  ? __pfx_kthread+0x10/0x10\n[  121.393393]  ret_from_fork+0x273/0x2b0\n[  121.393407]  ? __pfx_kthread+0x10/0x10\n[  121.393417]  ret_from_fork_asm+0x1a/0x30\n[  121.393432]  \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-14T16:27:31.892Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7565d4df66b6619b50dc36618d8b8f1787d77e19"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc6f36eaaedcf4b81af6fe1a568f018ffd530660"
        }
      ],
      "title": "ice: Fix PTP NULL pointer dereference during VSI rebuild",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23210",
    "datePublished": "2026-02-14T16:27:31.892Z",
    "dateReserved": "2026-01-13T15:37:45.986Z",
    "dateUpdated": "2026-02-14T16:27:31.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23210\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-14T17:15:58.910\",\"lastModified\":\"2026-02-18T17:52:22.253\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nice: Fix PTP NULL pointer dereference during VSI rebuild\\n\\nFix race condition where PTP periodic work runs while VSI is being\\nrebuilt, accessing NULL vsi-\u003erx_rings.\\n\\nThe sequence was:\\n1. ice_ptp_prepare_for_reset() cancels PTP work\\n2. ice_ptp_rebuild() immediately queues PTP work\\n3. VSI rebuild happens AFTER ice_ptp_rebuild()\\n4. PTP work runs and accesses NULL vsi-\u003erx_rings\\n\\nFix: Keep PTP work cancelled during rebuild, only queue it after\\nVSI rebuild completes in ice_rebuild().\\n\\nAdded ice_ptp_queue_work() helper function to encapsulate the logic\\nfor queuing PTP work, ensuring it\u0027s only queued when PTP is supported\\nand the state is ICE_PTP_READY.\\n\\nError log:\\n[  121.392544] ice 0000:60:00.1: PTP reset successful\\n[  121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000\\n[  121.392712] #PF: supervisor read access in kernel mode\\n[  121.392720] #PF: error_code(0x0000) - not-present page\\n[  121.392727] PGD 0\\n[  121.392734] Oops: Oops: 0000 [#1] SMP NOPTI\\n[  121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S                  6.19.0-rc6+ #4 PREEMPT(voluntary)\\n[  121.392761] Tainted: [S]=CPU_OUT_OF_SPEC\\n[  121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice]\\n[  121.393042] Call Trace:\\n[  121.393047]  \u003cTASK\u003e\\n[  121.393055]  ice_ptp_periodic_work+0x69/0x180 [ice]\\n[  121.393202]  kthread_worker_fn+0xa2/0x260\\n[  121.393216]  ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice]\\n[  121.393359]  ? __pfx_kthread_worker_fn+0x10/0x10\\n[  121.393371]  kthread+0x10d/0x230\\n[  121.393382]  ? __pfx_kthread+0x10/0x10\\n[  121.393393]  ret_from_fork+0x273/0x2b0\\n[  121.393407]  ? __pfx_kthread+0x10/0x10\\n[  121.393417]  ret_from_fork_asm+0x1a/0x30\\n[  121.393432]  \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nice: Soluciona la desreferencia de puntero NULL de PTP durante la reconstrucci\u00f3n de VSI\\n\\nSoluciona la condici\u00f3n de carrera donde el trabajo peri\u00f3dico de PTP se ejecuta mientras VSI est\u00e1 siendo reconstruido, accediendo a vsi-\u0026gt;rx_rings NULL.\\n\\nLa secuencia fue:\\n1. ice_ptp_prepare_for_reset() cancela el trabajo de PTP\\n2. ice_ptp_rebuild() encola inmediatamente el trabajo de PTP\\n3. La reconstrucci\u00f3n de VSI ocurre DESPU\u00c9S de ice_ptp_rebuild()\\n4. El trabajo de PTP se ejecuta y accede a vsi-\u0026gt;rx_rings NULL\\n\\nCorrecci\u00f3n: Mantener el trabajo de PTP cancelado durante la reconstrucci\u00f3n, solo encolarlo despu\u00e9s de que la reconstrucci\u00f3n de VSI se complete en ice_rebuild().\\n\\nSe a\u00f1adi\u00f3 la funci\u00f3n auxiliar ice_ptp_queue_work() para encapsular la l\u00f3gica de encolamiento del trabajo de PTP, asegurando que solo se encole cuando PTP es compatible y el estado es ICE_PTP_READY.\\n\\nRegistro de error:\\n[  121.392544] ice 0000:60:00.1: Reinicio de PTP exitoso\\n[  121.392692] BUG: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000000\\n[  121.392712] #PF: acceso de lectura de supervisor en modo kernel\\n[  121.392720] #PF: error_code(0x0000) - p\u00e1gina no presente\\n[  121.392727] PGD 0\\n[  121.392734] Oops: Oops: 0000 [#1] SMP NOPTI\\n[  121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S                  6.19.0-rc6+ #4 PREEMPT(voluntary)\\n[  121.392761] Tainted: [S]=CPU_OUT_OF_SPEC\\n[  121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice]\\n[  121.393042] Traza de Llamada:\\n[  121.393047] \\n[  121.393055] ice_ptp_periodic_work+0x69/0x180 [ice]\\n[  121.393202] kthread_worker_fn+0xa2/0x260\\n[  121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice]\\n[  121.393359] ? __pfx_kthread_worker_fn+0x10/0x10\\n[  121.393371] kthread+0x10d/0x230\\n[  121.393382] ? __pfx_kthread+0x10/0x10\\n[  121.393393] ret_from_fork+0x273/0x2b0\\n[  121.393407] ? __pfx_kthread+0x10/0x10\\n[  121.393417] ret_from_fork_asm+0x1a/0x30\\n[  121.393432] \"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7565d4df66b6619b50dc36618d8b8f1787d77e19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fc6f36eaaedcf4b81af6fe1a568f018ffd530660\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.