EUVD-2025-209789
GHSA-j2j9-q468-5q3f
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privilege per CVSS 4.0 match; scope changed because kernel crash terminates all user processes on the system.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Use after free for some Linux kernel driver for the Intel(R) Ethernet 800 series before version 2.3.14 within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (high) impacts.
AnalysisAI
Use-after-free in the Linux kernel ice driver for Intel Ethernet 800 series adapters before version 2.3.14 enables a local authenticated attacker with low privileges to trigger a kernel-level denial of service. The flaw resides in Ring 0 (kernel space), meaning heap corruption in the driver can cause kernel panics or system hangs with high availability impact to both the vulnerable system and subsequent dependent systems. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.01% (3rd percentile) reflects negligible near-term weaponization probability.
Technical ContextAI
CWE-416 (Use After Free) describes a condition in which kernel driver code retains a pointer to a memory region after that region has been deallocated; accessing it can corrupt the kernel heap or trigger invalid memory reads/writes. This vulnerability exists in the Linux kernel ice driver, which manages Intel Ethernet 800 series (E810 controller family) NICs and operates at Ring 0, the highest CPU privilege level. The affected CPE is cpe:2.3:a:n/a:intel(r)_ethernet_800_series:*:*:*:*:*:*:*:*, covering all driver versions prior to 2.3.14. Because the flaw is in kernel space, even a low-privilege user-mode trigger can cause the entire system to crash, as kernel heap corruption is not contained within a userland process boundary.
RemediationAI
Update the Intel Ethernet 800 series Linux kernel driver to version 2.3.14 or later per Intel Security Advisory INTEL-SA-01426 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01426.html). The ice driver may be delivered via the upstream Linux kernel tree or as a standalone DKMS package; administrators should apply the relevant distribution kernel errata or pull the updated out-of-tree driver from Intel. Where immediate patching is not feasible, restricting interactive local user access to hosts equipped with Intel E810 NICs reduces attack surface, though this carries operational trade-offs in shared or multi-tenant Linux environments. Disabling the ice driver entirely is a theoretically complete mitigation but would render the NIC inoperable and is only practical if alternate network interfaces are available.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today