CVE-2026-53289

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ice: fix NULL pointer dereference in ice_reset_all_vfs()

ice_reset_all_vfs() ignores the return value of ice_vf_rebuild_vsi().

When the VSI rebuild fails (e.g. during NVM firmware update via

nvmupdate64e), ice_vsi_rebuild() tears down the VSI on its error path,

leaving txq_map and rxq_map as NULL. The subsequent unconditional call

to ice_vf_post_vsi_rebuild() leads to a NULL pointer dereference in

ice_ena_vf_q_mappings() when it accesses vsi->txq_map[0].

The single-VF reset path in ice_reset_vf() already handles this

correctly by checking the return value of ice_vf_reconfig_vsi() and

skipping ice_vf_post_vsi_rebuild() on failure.

Apply the same pattern to ice_reset_all_vfs(): check the return value

of ice_vf_rebuild_vsi() and skip ice_vf_post_vsi_rebuild() and

ice_eswitch_attach_vf() on failure. The VF is left safely disabled

(ICE_VF_STATE_INIT not set, VFGEN_RSTAT not set to VFACTIVE) and can

be recovered via a VF

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References