CVE-2023-54037: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54037 is a NULL pointer dereference vulnerability in the Linux kernel's Intel ice (Ethernet) driver. It occurs when ethtool is called during a device reload (devlink dev reload), causing a kernel panic because the VSI (Virtual Switch Interface) is not yet configured while the network device is still alive. The vulnerability was published on December 24, 2025, and affects the Linux kernel. It carries an estimated CVSS severity of Medium (Feedly) with an EPSS score of 0.000180 (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the ice_get_ringparam() function of the Linux kernel's ice driver. During a driver reinit via devlink dev reload, the VSI is temporarily deconfigured while the network interface (netdev) remains active. If ethtool queries ring parameters during this window, it accesses tx_rings or rx_rings pointers that are NULL, triggering a kernel oops at ice_get_ringparam+0x22/0x50. The fix involves adding RTNL locking around VSI deconfig/config, zeroing num_q_vectors after freeing, adding NULL checks for tx/rx_rings in ring-related ethtool ops, and properly unrolling filters in ice_start_eth() (Feedly).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic (BUG/Oops) and system crash, directly impacting availability. An attacker or unprivileged local user capable of triggering ethtool queries during a device reload could crash the host, leading to denial of service. There is no evidence of confidentiality or integrity impact beyond the system crash (Feedly).

1. Local Access: Obtain local access to a Linux system with an Intel ice-driver NIC (e.g., Intel E810 series).
2. Trigger ethtool polling: Run watch -n 0.1 -d 'ethtool -g <interface>' to continuously query ring parameters on the target interface.
3. Initiate driver reload: Simultaneously execute devlink dev reload pci/<PCI_ID> action driver_reinit to trigger a driver reinit, causing the VSI to be temporarily deconfigured.
4. Race condition hit: If ethtool queries ice_get_ringparam() while tx_rings/rx_rings are NULL during the reload window, a NULL pointer dereference occurs.
5. Kernel panic: The kernel crashes with a BUG oops at ice_get_ringparam+0x22/0x50, resulting in a denial of service (Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing BUG: kernel NULL pointer dereference, address: 0000000000000000 with a call trace referencing ice_get_ringparam+0x22/0x50 [ice].
• Logs: Kernel oops entries with #PF: supervisor read access in kernel mode and Oops: 0000 [#1] PREEMPT SMP PTI in system logs.
• Process: Repeated ethtool process invocations (e.g., via watch) coinciding with devlink reload operations on Intel ice-driver interfaces.
• System: Unexpected system reboots or kernel panics on hosts with Intel E810-series NICs during network driver reload operations (Feedly).

Apply the upstream Linux kernel patches that address this vulnerability, available in the stable kernel tree (commits b3e7b3a6ee92 and ca03b327224e). The fix adds RTNL locking around VSI deconfig/config, zeroes num_q_vectors after freeing, adds NULL checks for tx/rx_rings in ethtool ring ops, and properly unrolls filters in ice_start_eth(). SUSE has issued advisories (SUSE-2026-0281-1 and SUSE-2026-20876-1) incorporating this fix; users should update to patched kernel packages from their distribution vendor (Feedly, Linux Security SUSE). As a workaround, avoid running ethtool queries concurrently with devlink dev reload operations on affected Intel ice NICs.