CVE-2026-53008

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ice: fix race condition in TX timestamp ring cleanup

Fix a race condition between ice_free_tx_tstamp_ring() and ice_tx_map()

that can cause a NULL pointer dereference.

ice_free_tx_tstamp_ring currently clears the ICE_TX_FLAGS_TXTIME flag

after NULLing the tstamp_ring. This could allow a concurrent ice_tx_map

call on another CPU to dereference the tstamp_ring, which could lead to

a NULL pointer dereference.

CPU A:ice_free_tx_tstamp_ring() | CPU B:ice_tx_map()

--------------------------------|---------------------------------

tx_ring->tstamp_ring = NULL |

| ice_is_txtime_cfg() -> true

| tstamp_ring = tx_ring->tstamp_ring

| tstamp_ring->count // NULL deref!

flags &= ~ICE_TX_FLAGS_TXTIME |

Fix by:

1. Reordering ice_free_tx_tstamp_ring() to clear the flag before

NULLing the pointer, with smp_wmb() to

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References