CVE-2026-23353: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23353 is a NULL pointer dereference vulnerability in the Linux kernel's ice network driver, triggered during the ethtool offline loopback test. The flaw was introduced after the ice driver was converted to use page pool, leaving the loopback VSI (ICE_VSI_LB) without a properly initialized q_vector/napi struct required by libeth_rx_fq_create(). It affects Linux kernel versions 6.19.0 through 6.19.6 and 7.0-rc1 through 7.0-rc7. Disclosed on March 25, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-824 (Access of Uninitialized Pointer). When the ice driver was converted to use page pool, ICE_VSI_LB (loopback) VSIs were not updated to include a q_vector containing a napi struct. During an ethtool offline loopback test, the call chain ice_loopback_test() → ice_vsi_cfg_rxqs() → ice_vsi_cfg_rxq() → ice_rxq_pp_create() → libeth_rx_fq_create() dereferences a NULL pointer at address 0x0c within ice_alloc_rx_bufs(), causing a kernel oops. Exploitation requires local access and the ability to invoke ethtool ioctl calls (low privilege) (Red Hat Bugzilla).

Successful exploitation causes a kernel NULL pointer dereference (oops/panic) in the ice_alloc_rx_bufs function, resulting in a denial of service — the system may crash or become unstable. The impact is limited to availability (High); there is no confidentiality or integrity impact. The vulnerability is locally triggered and does not enable code execution, privilege escalation, or lateral movement (Red Hat Advisory, Red Hat Bugzilla).

1. Identify target: Confirm the target system is running Linux kernel 6.19.0–6.19.6 or 7.0-rc1–7.0-rc7 with an Intel ice-driver-supported NIC (e.g., Intel E800 series).
2. Obtain local access: Gain local shell access with at least low-privileged user rights on the target system.
3. Identify the network interface: Use ip link or ls /sys/bus/pci/drivers/ice/ to identify the network interface managed by the ice driver (e.g., eth0).
4. Trigger the loopback test: Execute ethtool --test eth0 offline to invoke the ethtool offline self-test, which calls ice_self_test() → ice_loopback_test() → ice_vsi_cfg_rxqs() → ice_vsi_cfg_rxq() → ice_rxq_pp_create() → libeth_rx_fq_create().
5. Kernel crash occurs: The uninitialized q_vector/napi struct in the ICE_VSI_LB VSI causes a NULL pointer dereference at ice_alloc_rx_bufs+0x1cd, triggering a kernel oops/panic and denial of service (Red Hat Bugzilla).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries showing BUG: kernel NULL pointer dereference, address: 000000000000000c with RIP: 0010:ice_alloc_rx_bufs+0x1cd/0x310 [ice].
• Logs: Call trace in kernel logs referencing ice_vsi_cfg_rxq, ice_vsi_cfg_rxqs, ice_loopback_test, ice_self_test, ethtool_self_test.
• Process: ethtool process (PID visible in oops output) invoking offline self-test on an ice-managed interface immediately before the crash.
• System: Unexpected kernel panic or system reboot coinciding with ethtool offline test execution on a system with Intel E800-series NICs (Red Hat Bugzilla).

Apply the upstream kernel patches available at the stable kernel repository (commits 85c98b81849e4724ae99005a6cccd33cab9cfd18 and a9c354e656597aededa027d63d2ff0973f6b033f), which fix the issue by giving ICE_VSI_LB VSIs a dummy q_vector containing a napi struct for proper libeth initialization. Fixed kernel versions include 6.19.7 and later stable releases. As a workaround prior to patching, avoid running ethtool --test <iface> offline on systems with ice-driver NICs, and restrict ethtool offline test access via user privilege controls (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).