CVE-2025-39854: ice: fix NULL access of tx->in_use in ice_ll_ts_intr
In the Linux kernel, the following vulnerability has been resolved:
ice: fix NULL access of tx->inuse in icelltsintr
Recent versions of the E810 firmware have support for an extra interrupt to handle report of the "low latency" Tx timestamps coming from the specialized low latency firmware interface. Instead of polling the registers, software can wait until the low latency interrupt is fired.
This logic makes use of the Tx timestamp tracking structure, iceptptx, as it uses the same "ready" bitmap to track which Tx timestamps complete.
Unfortunately, the icelltsintr() function does not check if the tracker is initialized before its first access. This results in NULL dereference or use-after-free bugs similar to the issues fixed in the iceptptsirq() function.
Fix this by only checking the inuse bitmap (and other fields) if the tracker is marked as initialized. The reset flow will clear the init field under lock before it tears the tracker down, thus preventing any use-after-free or NULL access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the ice driver logic so ice_ll_ts_intr() performs NULL-safe access: only check tx->in_use (the ready/in_use bitmap used to determine completion) and any other required fields if the Tx timestamp tracking structure (ice_ptp_tx) is initialized/marked initialized, and ensure access is synchronized under the lock during teardown to prevent NULL dereference or use-after-free.
Linux kernel (ice Ethernet driver) ice_ll_ts_intr() NULL access check for tx->in_use (use in_use bitmap/fields only if safely initialized) = Add/ensure guard so the function only checks tx->in_use (and other referenced fields) after the Tx timestamp tracking structure is initialized and under the appropriate lock; prevent NULL access/use-after-free by synchronizing teardown and access.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39854?
CVE-2025-39854 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-39854?
To fix CVE-2025-39854, users should upgrade to the latest version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2025-39854?
CVE-2025-39854 affects systems running affected versions of the Linux kernel that do not incorporate the necessary patches.
What are the potential impacts of CVE-2025-39854?
The potential impacts of CVE-2025-39854 could include system instability and unintended behavior due to NULL access in the ice driver.
When was CVE-2025-39854 discovered?
CVE-2025-39854 was publicly disclosed along with the relevant patches in recent updates for the Linux kernel.