Read the docs
TI-2026-18647 Aliases CVE-2026-23210GHSA-7w83-2rgm-8vj5

ice: Fix PTP NULL pointer dereference during VSI rebuild

Priority LOW 20CWE-362Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 20 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

In the Linux kernel, the following vulnerability has been resolved: ice: Fix PTP NULL pointer dereference during VSI rebuild Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings. The sequence was: 1. ice_ptp_prepare_for_reset() cancels PTP work 2. ice_ptp_rebuild() immediately queues PTP work 3. VSI rebuild happens AFTER ice_ptp_rebuild() 4. PTP work runs and accesses NULL vsi->rx_rings Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild(). Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY. Error log: [ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: error_code(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=CPU_OUT_OF_SPEC [ 121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] <TASK> [ 121.393055] ice_ptp_periodic_work+0x69/0x180 [ice] [ 121.393202] kthread_worker_fn+0xa2/0x260 [ 121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice] [ 121.393359] ? __pfx_kthread_worker_fn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? __pfx_kthread+0x10/0x10 [ 121.393393] ret_from_fork+0x273/0x2b0 [ 121.393407] ? __pfx_kthread+0x10/0x10 [ 121.393417] ret_from_fork_asm+0x1a/0x30 [ 121.393432] </TASK>

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00097 0th percentileScored 2026-11-07
Fix Partial Linux (Linux): 6.12.80, 6.18.10, 6.19Red Hat: 4 advisoriesRed Hat: 20 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux6.9 and later6.12.80, 6.18.10, 6.19Patch availableCNA
  • Linux VendorLinux Affected 6.9 and later Fixed in 6.12.80, 6.18.10, 6.19 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*6.9 to before 6.18.10VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*6.19 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*6.19 rc2VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*6.19 rc3VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*6.19 rc4VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*6.19 rc5VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*6.19 rc6VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*6.19 rc7VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*6.19 rc8VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 6.9 to before 6.18.10 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:* Versions 6.19 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:* Versions 6.19 rc2 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:* Versions 6.19 rc3 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:* Versions 6.19 rc4 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:* Versions 6.19 rc5 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:* Versions 6.19 rc6 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:* Versions 6.19 rc7 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:* Versions 6.19 rc8 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 6.12.80, 6.18.10, 6.19

Red Hat 4 advisories

  • RHSA-2026:23224 Released 2026-06-04 · Red Hat rating Important
    kernel security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) kernel-tools-libs-devel-5.14.0-570.119.1.el9_6, libperf-5.14.0-570.119.1.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) kernel-64k-debug-devel-5.14.0-570.119.1.el9_6, kernel-64k-debug-devel-matched-5.14.0-570.119.1.el9_6, kernel-64k-devel-5.14.0-570.119.1.el9_6 +12
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel-5.14.0-570.119.1.el9_6, kernel-64k-5.14.0-570.119.1.el9_6, kernel-64k-core-5.14.0-570.119.1.el9_6 +28
    • Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt-5.14.0-570.119.1.el9_6, kernel-rt-64k-5.14.0-570.119.1.el9_6, kernel-rt-64k-core-5.14.0-570.119.1.el9_6 +21
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt-5.14.0-570.119.1.el9_6, kernel-rt-core-5.14.0-570.119.1.el9_6, kernel-rt-debug-5.14.0-570.119.1.el9_6 +11
  • RHSA-2026:22334 Released 2026-06-01 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) kernel-64k-debug-devel-6.12.0-55.76.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.76.1.el10_0, kernel-64k-devel-6.12.0-55.76.1.el10_0 +12
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel-6.12.0-55.76.1.el10_0, kernel-64k-6.12.0-55.76.1.el10_0, kernel-64k-core-6.12.0-55.76.1.el10_0 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) kernel-tools-libs-devel-6.12.0-55.76.1.el10_0, libperf-6.12.0-55.76.1.el10_0
    • Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt-6.12.0-55.76.1.el10_0, kernel-rt-64k-6.12.0-55.76.1.el10_0, kernel-rt-64k-core-6.12.0-55.76.1.el10_0 +21
    • Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt-6.12.0-55.76.1.el10_0, kernel-rt-core-6.12.0-55.76.1.el10_0, kernel-rt-debug-6.12.0-55.76.1.el10_0 +11
  • RHSA-2026:18134 Released 2026-05-19 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-211.7.1.el10_2, kernel-64k-debug-devel-matched-6.12.0-211.7.1.el10_2, kernel-64k-devel-6.12.0-211.7.1.el10_2 +12
    • Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-211.7.1.el10_2, kernel-64k-6.12.0-211.7.1.el10_2, kernel-64k-core-6.12.0-211.7.1.el10_2 +29
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-211.7.1.el10_2, libperf-6.12.0-211.7.1.el10_2
    • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-211.7.1.el10_2, kernel-rt-64k-6.12.0-211.7.1.el10_2, kernel-rt-64k-core-6.12.0-211.7.1.el10_2 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-211.7.1.el10_2, kernel-rt-core-6.12.0-211.7.1.el10_2, kernel-rt-debug-6.12.0-211.7.1.el10_2 +9
Show 1 more Red Hat advisories
  • RHSA-2026:6570 Released 2026-04-06 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-611.47.1.el9_7, kernel-64k-debug-devel-matched-5.14.0-611.47.1.el9_7, kernel-64k-devel-5.14.0-611.47.1.el9_7 +12
    • Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-611.47.1.el9_7, kernel-64k-5.14.0-611.47.1.el9_7, kernel-64k-core-5.14.0-611.47.1.el9_7 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-611.47.1.el9_7, libperf-5.14.0-611.47.1.el9_7
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-611.47.1.el9_7, kernel-rt-64k-5.14.0-611.47.1.el9_7, kernel-rt-64k-core-5.14.0-611.47.1.el9_7 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-611.47.1.el9_7, kernel-rt-core-5.14.0-611.47.1.el9_7, kernel-rt-debug-5.14.0-611.47.1.el9_7 +9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:23224
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:18134
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:6570
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:22334
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:23224
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:18134
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:6570
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:22334
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:23224
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:18134
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:6570
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:22334
Red Hat Enterprise Linux Real Time (v. 10)Fixed RHSA-2026:18134
Red Hat Enterprise Linux Real Time (v. 9)Fixed RHSA-2026:6570
Red Hat Enterprise Linux Real Time EUS (v. 10.0)Fixed RHSA-2026:22334
Red Hat Enterprise Linux Real Time EUS (v.9.6)Fixed RHSA-2026:23224
Red Hat Enterprise Linux Real Time for NFV (v. 10)Fixed RHSA-2026:18134
Red Hat Enterprise Linux Real Time for NFV (v. 9)Fixed RHSA-2026:6570
Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)Fixed RHSA-2026:22334
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)Fixed RHSA-2026:23224
Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23210
  2. 2026-10-03 Alias added: GHSA-7w83-2rgm-8vj5
  3. 2026-10-19 Weakness changed · CISA ADP

References

Patch 2

Other 1

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences