CVE-2026-23210

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix PTP NULL pointer dereference during VSI rebuild

Fix race condition where PTP periodic work runs while VSI is being

rebuilt, accessing NULL vsi->rx_rings.

The sequence was:

1. ice_ptp_prepare_for_reset() cancels PTP work

2. ice_ptp_rebuild() immediately queues PTP work

3. VSI rebuild happens AFTER ice_ptp_rebuild()

4. PTP work runs and accesses NULL vsi->rx_rings

Fix: Keep PTP work cancelled during rebuild, only queue it after

VSI rebuild completes in ice_rebuild().

Added ice_ptp_queue_work() helper function to encapsulate the logic

for queuing PTP work, ensuring it's only queued when PTP is supported

and the state is ICE_PTP_READY.

Error log:

[ 121.392544] ice 0000:60:00.1: PTP reset successful

[ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000

[ 121.392712] #PF: supervisor read access in kernel mode

[ 121.392720] #PF: error_code(0x0000) - not-present page

[ 121.392727] PG

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References