CVE-2025-39855: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39855 is a NULL pointer dereference and use-after-free vulnerability in the Linux kernel's Intel ice network driver, specifically within the ice_ptp_ts_irq() function. The flaw affects Linux kernel versions from 6.15 up to (but not including) 6.16.6, as well as release candidates 6.17-rc1 through 6.17-rc4. It was published on September 19, 2025, with patches available from the Linux kernel stable tree and Red Hat. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-416 (Use After Free), with an additional NULL pointer dereference component. The Intel E810 network device uses a "low latency" firmware interface for Tx timestamps that bypasses the standard AdminQ sideband path but still relies on the ice_ptp_tx tracking structure and its in_use bitmap. The ice_ptp_ts_irq() function fails to verify that the tracker is initialized before accessing it, creating a race condition: if a Tx timestamp interrupt fires concurrently with driver reset logic tearing down the tracker, the function may dereference a NULL or already-freed pointer. The fix ensures the in_use bitmap and related fields are only accessed when the tracker's init flag is set, with the reset flow clearing this flag under lock before teardown (Red Hat Bugzilla).

Successful exploitation can cause a kernel NULL pointer dereference or use-after-free, leading to kernel panic, system crash, or denial of service on affected hosts. A local attacker with low-privileged access on a system using an Intel E810 NIC could trigger this condition, with potential high impact to confidentiality, integrity, and availability as reflected in the CVSS score. The vulnerability is confined to the local system scope but could be leveraged as part of a privilege escalation chain (Red Hat Advisory, Red Hat Bugzilla).

Update the Linux kernel to version 6.16.6 or later, which includes the fix for this vulnerability. Patches are also available via the Linux kernel stable git tree (commits 1467a873b201 and 403bf043d934) and through Red Hat's security channels. Organizations running Red Hat Enterprise Linux should apply the relevant kernel errata as provided. As a temporary measure, systems without Intel E810 NICs are not affected and require no action (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).