CVE-2023-54166: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54166 is a kernel panic vulnerability in the Linux kernel's igc (Intel I225/I226 Ethernet) driver, triggered during the ndo_tx_timeout callback. The flaw arises from a race condition between the transmit queue timeout handler (igc_tx_timeout) and interface bring-down/bring-up operations (igc_reinit_locked), which can cause a kernel panic when igc_clean_tx_irq is called concurrently. The vulnerability was published on December 30, 2025, and affects the Linux kernel's igc network driver (Feedly). No CVSS score has been assigned at this time, and the CVE status is listed as Unknown.

The root cause is a race condition (CWE-362) in the igc driver's TX timeout handling path. When igc_tx_timeout() is invoked due to a transmit queue stall, it triggers igc_down() to reset the adapter; however, if an interrupt fires concurrently and igc_clean_tx_irq() attempts to process completed TX descriptors, the simultaneous access to TX ring HW queues can result in a kernel panic. The fix disables all TX ring HW queues during igc_down() and re-enables them during igc_configure_tx_ring() as part of igc_up(), eliminating the race window. The kernel trace shows the panic originating from net/sched/sch_generic.c:525 in the dev_watchdog function (Feedly).

Successful triggering of this vulnerability causes a kernel panic (system crash), resulting in a complete loss of availability for the affected host. The impact is limited to systems using the igc driver (Intel I225/I226 Gigabit Ethernet controllers), and exploitation requires local access or the ability to induce network conditions that cause TX queue timeouts. There is no known confidentiality or integrity impact; the primary risk is denial of service through an unplanned system reboot (Feedly).

The fix has been committed to the Linux kernel stable tree via multiple patches (commits c09df09241fd, c12554d97fcd, d4a7ce642100, and feba294c454a) (Kernel Git). Users should update to a patched kernel version that includes these commits. Red Hat has also tracked this issue for their distributions (Red Hat CVE). As a workaround, avoiding the use of affected Intel I225/I226 NICs in high-load environments or replacing them with alternative hardware can reduce exposure until a patched kernel is deployed.