Skip to main content

Linux Kernel CVE-2026-53007

| EUVDEUVD-2026-38875 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-9j35-6cp9-6x6g
Null Pointer Dereference Linux Denial Of Service Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Error path requires both active TXTIME flag and a setup failure to trigger, making AC:H more accurate than the reported AC:L; impact is pure DoS with no confidentiality or integrity effect.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 22, 2026 - 20:51 vuln.today
CVSS changed
Jul 14, 2026 - 19:22 NVD
5.5 (MEDIUM)
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ice: fix potential NULL pointer deref in error path of ice_set_ringparam()

ice_set_ringparam nullifies tstamp_ring of temporary tx_rings, without clearing ICE_TX_RING_FLAGS_TXTIME bit. When ICE_TX_RING_FLAGS_TXTIME is set and the subsequent ice_setup_tx_ring() call fails, a NULL pointer dereference could happen in the unwinding sequence:

ice_clean_tx_ring() -> ice_is_txtime_cfg() == true (ICE_TX_RING_FLAGS_TXTIME is set) -> ice_free_tx_tstamp_ring() -> ice_free_tstamp_ring() -> tstamp_ring->desc (NULL deref)

Clear ICE_TX_RING_FLAGS_TXTIME bit to avoid the potential issue.

Note that this potential issue is found by manual code review. Compile test only since unfortunately I don't have E830 devices.

AnalysisAI

NULL pointer dereference in the Linux kernel ice driver's error path can cause a kernel panic on systems using Intel E800/E830 series Ethernet adapters. The flaw in ice_set_ringparam() leaves the ICE_TX_RING_FLAGS_TXTIME bit set after nullifying tstamp_ring, so a subsequent failure in ice_setup_tx_ring() triggers a dereference of a NULL tstamp_ring->desc pointer during error unwinding. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with the discoverer's note that this was identified by manual code review rather than observed exploitation.

Technical ContextAI

The ice driver (drivers/net/ethernet/intel/ice) is the Linux kernel module for Intel E800/E830 series Ethernet adapters, which support hardware TX timestamping via TXTIME rings. The vulnerable function ice_set_ringparam() allocates temporary tx_rings during ring parameter changes via ethtool. It nullifies the tstamp_ring pointer in those temporary rings but neglects to clear the ICE_TX_RING_FLAGS_TXTIME flag. CWE-476 (NULL Pointer Dereference) manifests when ice_setup_tx_ring() fails: the cleanup sequence calls ice_clean_tx_ring(), which checks ice_is_txtime_cfg() - returning true because the flag is still set - and then calls ice_free_tx_tstamp_ring() → ice_free_tstamp_ring(), which dereferences tstamp_ring->desc, a NULL pointer. CPE data (cpe:2.3:a:linux:linux:*) confirms the Linux kernel as the affected product across multiple stable branches.

RemediationAI

Apply the upstream kernel fixes available at https://git.kernel.org/stable/c/fa28351f970fa5138c7c5dedfe5dea480a0ee065 and https://git.kernel.org/stable/c/c54e3c270384829336b2526033d44ce1aa6dc67c; these patches clear the ICE_TX_RING_FLAGS_TXTIME bit when nullifying tstamp_ring, closing the error-path gap. EUVD data identifies Linux 7.0.10 and 7.1 as patched stable releases. Ubuntu users should apply the kernel updates published in USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1) and USN-8568-1 (https://ubuntu.com/security/notices/USN-8568-1). As a targeted workaround on systems where patching is delayed, disabling the TXTIME/hardware TX timestamping feature on affected ice driver interfaces prevents the vulnerable flag state from being reached; note this disables time-sensitive networking (TSN) capabilities that may be required for applications relying on hardware transmit timestamping.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Null Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53007 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy