CVE-2026-23117

A flaw was found in the Linux kernel's Intel ice network driver. When performing a devlink-reload operation, the ice_devlink_reinit_down() function fails to call ice_deinit_hw() to properly uninitialize the hardware control queues. This causes the subsequent ice_init_hw() call to fail with -EBUSY. If the driver is then removed, a NULL pointer dereference occurs in ice_unload(), leading to a kernel crash.

Triggering this flaw requires administrator privileges to perform devlink-reload operations, followed by driver removal. The vulnerability is specific to the ice driver used with Intel Ethernet 800 Series adapters and requires a specific sequence of administrative operations. The kernel crash can occur in the Intel ice driver when using the devlink reload workflow. A prior change removed a deinitialization call from a shared deinit helper. As a consequence the devlink reinit down path no longer deinitialized the hardware control queues via ice_deinit_hw. The devlink reinit up path still calls ice_init_hw. With control queues left initialized the subsequent init can fail with -EBUSY. After this inconsistent state a later device removal or module unload can hit a NULL pointer dereference in the ice unload remove path, resulting in a local denial of service. Triggering conditions require local access capable of invoking devlink reload operations, which typically maps to administrative privileges such as CAP_NET_ADMIN.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ice module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist kernel modules.