Linux EUVD-2026-18690

The Intel igc network driver (cpe:2.3:a:linux:linux) implements XDP (eXpress Data Path) support with TX packet timestamping capability for precision packet transmission timing. XDP programs can request hardware TX timestamps, which are handled asynchronously by the igc_ptp_tx_tstamp_event() interrupt handler. The vulnerability exists in the interaction between XDP socket metadata (xsk_meta) and TX ring lifecycle management. When an XDP application shuts down its TX ring while the interface link remains up, the driver fails to properly clean up xsk_meta pointers. Subsequently, when hardware TX timestamp events occur, the igc_tsync_interrupt() handler invokes igc_ptp_tx_tstamp_event() to process pending timestamps, which attempts to dereference stale xsk_meta pointers that have been freed or unmapped by the application, resulting in an unhandled page fault that crashes the kernel.