CVE-2026-53289: Linux ice Driver NULL Pointer Dereference During VF Reset

Technical summary

CVE-2026-53289 is a NULL pointer dereference in the ice driver's ice_reset_all_vfs() function. When ice_vf_rebuild_vsi() fails (commonly during NVM firmware updates via nvmupdate64e), the VSI's txq_map and rxq_map remain NULL after the error path tears down the VSI structure. The function ignores this failure and unconditionally calls ice_vf_post_vsi_rebuild(), which subsequently calls ice_ena_vf_q_mappings() and dereferences vsi->txq_map[0], triggering a page fault and kernel panic. The single-VF reset path (ice_reset_vf()) already handles this correctly by checking the return value and skipping the problematic call; the all-VF path was missing this defensive check. The fix applies the same pattern: verify the rebuild succeeded before proceeding with post-rebuild configuration.

Business impact

This vulnerability causes kernel panics on systems with ice-based NICs during VF resets, particularly during firmware update operations using nvmupdate64e. The crashes render the affected system unavailable until rebooted, impacting production workloads relying on these network interfaces or virtualization features. Organizations performing firmware maintenance face potential unplanned downtime. Systems not performing VF resets or firmware updates are not exposed to this trigger.

Affected systems

The vulnerability affects the Linux kernel (all versions prior to the fix commit). Specifically impacted are systems running ice network driver with SR-IOV capable Intel network hardware where virtual functions are in use or where NVM firmware updates are performed. The crash manifestation requires the specific condition of a VSI rebuild failure during an all-VF reset operation.

Exploitability

This is not a privilege escalation or information disclosure vulnerability. It is a reliability/availability issue requiring local access and specific operational conditions (NVM firmware update via nvmupdate64e triggering an all-VF reset while VSI rebuild fails). The vulnerability cannot be exploited remotely. Exploitation requires administrative capabilities to perform firmware updates or trigger VF resets, and the crash is deterministic only when the underlying VSI rebuild fails, which occurs during firmware transitions.

Remediation

Apply a kernel update incorporating the fix, which adds proper error handling to ice_reset_all_vfs(). The patch checks the return value of ice_vf_rebuild_vsi() and skips ice_vf_post_vsi_rebuild() and ice_eswitch_attach_vf() calls on failure, leaving the VF in a safely disabled state. VFs can then be recovered via VFLR (Virtual Function Level Reset) triggered by PCI reset or driver rebind. Verify the specific kernel version containing this commit against your distribution's advisory.

Patch guidance

Obtain the patched kernel version from your Linux distribution. The fix involves adding a conditional check around the post-VSI-rebuild operations in ice_reset_all_vfs(). Most major distributions will backport this to their supported kernel branches. Check your vendor's security advisories for the specific patched version numbers. After patching, reboot affected systems to load the fixed kernel.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for page fault panics in ice_ena_vf_q_mappings() or general Oops messages during NVM firmware update operations or when ice driver performs VF resets. Systems experiencing unplanned reboots during firmware maintenance with ice-based NICs may be affected. The crash stack trace will include ice_reset_all_vfs -> ice_sriov_post_vsi_rebuild -> ice_ena_vf_q_mappings. Collect kernel crash dumps if kdump is configured to preserve evidence for analysis.

Why prioritize this

Assign medium priority. The CVSS score of 5.5 reflects local availability impact only. However, the crash occurs in a predictable scenario (firmware updates), affects production systems unexpectedly, and may be triggered during routine maintenance. Organizations performing NVM updates on ice-based hardware should patch before next scheduled update windows. Systems without SR-IOV or VF usage can defer patching if no firmware updates are planned.

Risk score, explained

The CVSS v3.1 score of 5.5 (MEDIUM) is assigned: AV:L (local only), AC:L (low complexity), PR:L (low privilege required—administrative firmware update capability), UI:N (no user interaction), S:U (no scope change), C:N (no confidentiality impact), I:N (no integrity impact), A:H (high availability impact via kernel crash). The lack of remote exploitability and requirement for administrative operations keep the score in the medium range despite the severe local impact.

Frequently asked questions