CVE-2026-23166: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23166 is a NULL pointer dereference vulnerability in the Linux kernel's Intel ice (E810) Ethernet driver, specifically within the ice_vsi_set_napi_queues() function. The flaw occurs during resume from suspend when rings[q_idx]->q_vector is NULL, causing a kernel crash. It was published on February 14, 2026, and affects Linux kernel versions from 6.10.10 up to (but not including) 6.11, from 6.11.1 up to (but not including) 6.12.69, and from 6.13 up to (but not including) 6.18.9, as well as several 6.19 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). During a system suspend/resume cycle, the ice_vsi_set_napi_queues() function in the ice driver calls netif_queue_set_napi() without first verifying that rings[q_idx]->q_vector is non-NULL, leading to a kernel oops at address 0x0000000000000040 with RIP pointing to netif_queue_set_napi+0xa/0x170. The issue is reproducible on systems with Intel E810-XXV adapters regardless of SR-IOV state (both enabled and disabled), triggered by standard suspend operations such as systemctl suspend or rtcwake. The fix adds explicit NULL pointer checks before dereferencing the ring's q_vector pointer (Feedly, Kernel Patch 1).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a system crash (kernel oops/panic) and complete loss of availability for the affected host. The impact is limited to availability — there is no confidentiality or integrity impact. Systems running affected kernel versions with Intel E810-series Ethernet controllers are at risk of an unplanned reboot or denial of service whenever a suspend/resume cycle is performed (Feedly).

• Logs: Kernel log entries containing BUG: kernel NULL pointer dereference, address: 0000000000000040 followed by RIP: 0010:netif_queue_set_napi+0xa/0x170 and an Oops: 0000 [#1] SMP NOPTI trace in /var/log/kern.log or dmesg output.
• Process/System: Unexpected system reboot or kernel panic occurring immediately after a suspend/resume cycle on hosts with Intel E810-series Ethernet adapters.
• Hardware Context: Presence of PCI device 8086:159b (Intel Corporation Ethernet Controller E810-XXV for SFP) identifiable via lspci output on affected systems (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability across three stable branches: kernel versions 6.11 (patch commit 36126ddbe924), 6.12.69 (patch commit 9bb30be4d89f), and 6.18.9 (patch commit d75c7b7c3c2b). Users should update to kernel version 6.12.69, 6.18.9, or later as appropriate for their distribution. Oracle Linux and Ubuntu have issued updated kernel packages incorporating this fix. As a temporary workaround, administrators can avoid suspend/resume cycles on affected systems with Intel E810 adapters until a patched kernel is applied (Feedly, Oracle Advisory, Ubuntu Advisory).

The vulnerability has received routine coverage from Linux distribution security channels, including Oracle Linux and Ubuntu security advisories, as well as German Linux security news outlet pro-linux.de. No notable researcher commentary, vendor statements beyond patch releases, or significant social media discussion has been identified for this vulnerability.