CVE-2026-97978

A flaw was found in the Linux kernel's Intel Ethernet driver (ice). Event tracing routines dereferenced internal data pointers when formatting log messages instead of capturing the necessary values when the event was recorded. A local user with administrative access or tracing privileges could trigger an invalid pointer access if the referenced network structures are freed before trace messages are displayed, resulting in a Denial of Service (DoS) via a kernel crash.

A flaw was found in the Linux kernel's Intel Ethernet (ice) driver, rated moderate by Red Hat Product Security, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS-based OpenShift Container Platform 4 releases. The ice driver's trace events (such as ice_tx_dim_work and ice_rx_dim_work) dereferenced pointers to internal data structures (q_vector, tx/rx rings, and dynamic interrupt moderation instances) when the trace messages were printed rather than capturing the values when the event was recorded. Because printing can happen long after the event was recorded, the referenced structures may already have been freed, so a local user with administrative access or tracing privileges who has these tracepoints enabled could trigger an invalid pointer access that crashes the kernel, resulting in a denial of service. There is no impact to confidentiality or integrity. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable ice tracepoint code is not present in those releases. Fixes for the affected Red Hat products are currently deferred: the flaw is of moderate severity, can only be triggered by a locally privileged user with the affected tracing enabled, and impacts availability only, so the residual risk of deferring the fix is limited to a local denial of service. Red Hat rated this flaw with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The invalid pointer dereference only occurs when the affected ice driver trace events have been recorded and are later printed through the kernel tracing interface. As a workaround, avoid enabling (or disable) the ice driver trace events in tracefs/ftrace on affected systems; with these tracepoints not active, the stale pointers are not dereferenced. No other mitigation is currently available beyond updating to a release that contains the fix once it is provided.