CVE-2026-53007: ice: fix potential NULL pointer deref in error path of ice_set_ringparam()
In the Linux kernel, the following vulnerability has been resolved:
ice: fix potential NULL pointer deref in error path of icesetringparam()
icesetringparam nullifies tstampring of temporary txrings, without clearing ICETXRINGFLAGSTXTIME bit. When ICETXRINGFLAGSTXTIME is set and the subsequent icesetuptxring() call fails, a NULL pointer dereference could happen in the unwinding sequence:
icecleantxring() -> iceistxtimecfg() == true (ICETXRINGFLAGSTXTIME is set) -> icefreetxtstampring() -> icefreetstampring() -> tstampring->desc (NULL deref)
Clear ICETXRINGFLAGSTXTIME bit to avoid the potential issue.
Note that this potential issue is found by manual code review. Compile test only since unfortunately I don't have E830 devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Clear the ICE_TX_RING_FLAGS_TXTIME bit to avoid the potential NULL dereference when ice_setup_tx_ring() fails in the error/unwinding path (tstamp_ring may be NULL).
ice driver (ice_set_ringparam / TX timestamp ring flags) ICE_TX_RING_FLAGS_TXTIME = clear (disable) the bit - Compensating control
Compile/test the change only (no E830 devices available), per the provided guidance.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53007?
The severity of CVE-2026-53007 is rated at 19.
How do I fix CVE-2026-53007?
To fix CVE-2026-53007, ensure that you update your Intel ice driver to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-53007?
CVE-2026-53007 is classified as a Null Pointer Dereference vulnerability.
Which component is affected by CVE-2026-53007?
CVE-2026-53007 affects the Intel ice driver in the Linux kernel.
What issue does CVE-2026-53007 resolve?
CVE-2026-53007 resolves a potential NULL pointer dereference in the error path of the ice_set_ringparam() function.