Riskcovery

CVE-2026-53007

ice: fix potential NULL pointer deref in error path of ice_set_ringparam()

State
Published
Severity
Not scored
Published
Jun 24, 2026
Updated
Oct 15, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ice: fix potential NULL pointer deref in error path of ice_set_ringparam()

ice_set_ringparam nullifies tstamp_ring of temporary tx_rings, without clearing ICE_TX_RING_FLAGS_TXTIME bit. When ICE_TX_RING_FLAGS_TXTIME is set and the subsequent ice_setup_tx_ring() call fails, a NULL pointer dereference could happen in the unwinding sequence:

ice_clean_tx_ring() -> ice_is_txtime_cfg() == true (ICE_TX_RING_FLAGS_TXTIME is set) -> ice_free_tx_tstamp_ring() -> ice_free_tstamp_ring() -> tstamp_ring->desc (NULL deref)

Clear ICE_TX_RING_FLAGS_TXTIME bit to avoid the potential issue.

Note that this potential issue is found by manual code review. Compile test only since unfortunately I don't have E830 devices.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 to before c789649d4334a3767210071311d58bc8e74bdec1Affected
  • ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 to before c54e3c270384829336b2526033d44ce1aa6dc67cAffected
  • ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 to before fa28351f970fa5138c7c5dedfe5dea480a0ee065Affected
LinuxLinux
  • 6.18Affected
  • before 6.18Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.0.10 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.