CVE-2026-23117: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23117 is a NULL pointer dereference vulnerability in the Linux kernel's ice network driver affecting the devlink reload mechanism. The flaw was introduced when commit 1390b8b3d2be removed ice_deinit_hw() from ice_deinit_dev(), leaving ice_devlink_reinit_down() without a corresponding call to ice_deinit_hw() while ice_devlink_reinit_up() still calls ice_init_hw(). This asymmetry causes ice_init_hw() to fail with -EBUSY (control queues not uninitialized), and subsequent driver removal triggers a NULL pointer dereference in ice_unload. Affected versions include Linux kernel 6.18.2 through 6.18.7 and 6.19-rc1 through 6.19-rc6. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference), stemming from an imbalanced hardware initialization/deinitialization sequence in the ice driver's devlink reload path. Specifically, ice_devlink_reinit_down() was missing a call to ice_deinit_hw() after commit 1390b8b3d2be refactored error paths, while ice_devlink_reinit_up() retained its call to ice_init_hw(). When a devlink-reload is triggered, the control queues remain initialized; the subsequent ice_init_hw() call fails with -EBUSY (-16), and when the driver is then removed, ice_unload() and ice_remove() dereference a NULL pointer due to the inconsistent state. Exploitation requires local access and low privileges to invoke the devlink reload interface (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation causes a kernel panic (NULL pointer dereference) resulting in a denial of service — the affected system crashes or becomes unavailable. The impact is limited to availability (no confidentiality or integrity impact), affecting systems equipped with Intel NICs using the ice driver. Unplanned downtime on network-critical infrastructure using these Intel adapters is the primary risk (Feedly).

1. Prerequisite: Obtain local access with low-privilege credentials on a Linux system running kernel 6.18.2–6.18.7 or 6.19-rc1 through 6.19-rc6, equipped with an Intel NIC managed by the ice driver.
2. Identify target interface: Confirm the ice driver is loaded and the devlink interface is accessible (e.g., devlink dev show to list devices).
3. Trigger devlink reload: Execute devlink dev reload pci/<BDF> (where <BDF> is the PCI bus/device/function of the Intel NIC) to invoke ice_devlink_reinit_down() followed by ice_devlink_reinit_up(). Due to the missing ice_deinit_hw() call, ice_init_hw() fails with -EBUSY.
4. Remove the driver: Unload the ice module (e.g., rmmod ice or trigger device removal), causing ice_unload() and ice_remove() to dereference a NULL pointer, resulting in a kernel panic and system crash (Feedly).

• Logs: Kernel log entries containing ice 0000:XX:00.0: ice_init_hw failed: -16 following a devlink reload operation.
• Logs: Kernel call trace referencing ice_unload+0x8f/0x100 [ice] and ice_remove+0xba/0x300 [ice] in dmesg or /var/log/kern.log.
• Process/System: Unexpected kernel panic or system reboot on hosts with Intel NICs, particularly after devlink operations.
• Logs: Audit logs showing devlink dev reload commands issued by low-privileged local users on systems with ice driver NICs (Feedly).

The vulnerability is resolved in Linux kernel version 6.18.8 and later, via commits 42fb5f3deb58 and a3d99e2fbf01, which add ice_deinit_hw() to ice_devlink_reinit_down(). Administrators should update to kernel 6.18.8 or a later stable release as the primary remediation. As a workaround, restrict local access and CAP_NET_ADMIN / devlink capabilities to trusted users only, and avoid performing devlink-reload on affected kernel versions until patched (Feedly, Kernel Patch 1, Kernel Patch 2).