CVE-2026-23210None▾ Sunlit

ice: Fix PTP NULL pointer dereference during VSI rebuild

In the Linux kernel, the following vulnerability has been resolved: ice: Fix PTP NULL pointer dereference during VSI rebuild Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings. The…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Feb 14, 2026

Updated

Oct 19, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.12% · p2

Platforms

—

Source

CVEORG

Vector

—

CISA SSVC

decided 2026-06-10

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 247 days

Feb 14, 2026Published
Disclosed via CVEORG
Oct 19, 2026Record revised
Last analysed / modified upstream
Oct 19, 2026EPSS first tracked
0.1%

Linux #cve.org

Affected

Linux >= 803bef817807d2d36c930dada20c96fffae0dd19 < ba0c7fff6616025a7d3a9e887e7ce16b06dc34b9
Linux >= 803bef817807d2d36c930dada20c96fffae0dd19 < 7565d4df66b6619b50dc36618d8b8f1787d77e19
Linux >= 803bef817807d2d36c930dada20c96fffae0dd19 < fc6f36eaaedcf4b81af6fe1a568f018ffd530660
Linux 6.9

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix PTP NULL pointer dereference during VSI rebuild

Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings.

The sequence was:

ice_ptp_prepare_for_reset() cancels PTP work
ice_ptp_rebuild() immediately queues PTP work
VSI rebuild happens AFTER ice_ptp_rebuild()
PTP work runs and accesses NULL vsi->rx_rings

Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild().

Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY.

Error log: [ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: error_code(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=CPU_OUT_OF_SPEC [ 121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] <TASK> [ 121.393055] ice_ptp_periodic_work+0x69/0x180 [ice] [ 121.393202] kthread_worker_fn+0xa2/0x260 [ 121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice] [ 121.393359] ? __pfx_kthread_worker_fn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? __pfx_kthread+0x10/0x10 [ 121.393393] ret_from_fork+0x273/0x2b0 [ 121.393407] ? __pfx_kthread+0x10/0x10 [ 121.393417] ret_from_fork_asm+0x1a/0x30 [ 121.393432] </TASK>

Affected

Linux >= 803bef817807d2d36c930dada20c96fffae0dd19 < ba0c7fff6616025a7d3a9e887e7ce16b06dc34b9
Linux >= 803bef817807d2d36c930dada20c96fffae0dd19 < 7565d4df66b6619b50dc36618d8b8f1787d77e19
Linux >= 803bef817807d2d36c930dada20c96fffae0dd19 < fc6f36eaaedcf4b81af6fe1a568f018ffd530660
Linux 6.9

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

ice: Fix PTP NULL pointer dereference during VSI rebuild

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix PTP NULL pointer dereference during VSI rebuild

Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings.

The sequence was:

ice_ptp_prepare_for_reset() cancels PTP work

ice_ptp_rebuild() immediately queues PTP work

VSI rebuild happens AFTER ice_ptp_rebuild()

PTP work runs and accesses NULL vsi->rx_rings

Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild().

Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY.