CVE-2026-53008: ice: fix race condition in TX timestamp ring cleanup
In the Linux kernel, the following vulnerability has been resolved:
ice: fix race condition in TX timestamp ring cleanup
Fix a race condition between icefreetxtstampring() and icetxmap() that can cause a NULL pointer dereference.
icefreetxtstampring currently clears the ICETXFLAGSTXTIME flag after NULLing the tstampring. This could allow a concurrent icetxmap call on another CPU to dereference the tstampring, which could lead to a NULL pointer dereference.
CPU A:icefreetxtstampring() | CPU B:icetxmap() --------------------------------|--------------------------------- txring->tstampring = NULL | | iceistxtimecfg() -> true | tstampring = txring->tstampring | tstampring->count // NULL deref! flags &= ~ICETXFLAGSTXTIME |
Fix by: 1. Reordering icefreetxtstampring() to clear the flag before NULLing the pointer, with smpwmb() to ensure proper ordering. 2. Adding smprmb() in icetxmap() after the flag check to order the flag read before the pointer read, using READONCE() for the pointer, and adding a NULL check as a safety net. 3. Converting txring->flags from u8 to DECLAREBITMAP() and using atomic bitops (setbit(), clearbit(), testbit()) for all flag operations throughout the driver: - ICETXRINGFLAGSXDP - ICETXRINGFLAGSVLANL2TAG1 - ICETXRINGFLAGSVLANL2TAG2 - ICETXRINGFLAGSTXTIME
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the described kernel code change to fix the NULL pointer dereference race in ice_free_tx_tstamp_ring() vs ice_tx_map(): reorder cleanup so the TX timestamp ring pointer is NULLed with smp_wmb() before clearing the ICE_TX_FLAGS_TXTIME flag; add smp_rmb() in ice_tx_map() after the flag check before dereferencing tx_ring->tstamp_ring; convert tx_ring->flags from u8 to DECLARE_BITMAP() and use atomic bitops (set_bit(), clear_bit(), test_bit()) for all flags; use READ_ONCE() for the flags read and add a NULL check before using tstamp_ring->count.
Linux kernel (ice driver TX timestamp ring cleanup) ICE_TX_FLAGS_TXTIME handling/race fix = Use smp_wmb()/smp_rmb() ordering and NULL pointering before clearing related flags; add READ_ONCE() and NULL check
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53008?
The severity of CVE-2026-53008 is medium with a CVSS score of 4.7.
How do I fix CVE-2026-53008?
To fix CVE-2026-53008, update your Linux kernel to the latest version where this vulnerability is resolved.
What type of vulnerability is CVE-2026-53008?
CVE-2026-53008 is a race condition vulnerability that can lead to a null pointer dereference.
Which software is affected by CVE-2026-53008?
CVE-2026-53008 affects the Linux kernel, specifically the ice driver.
When was CVE-2026-53008 published?
CVE-2026-53008 was published on June 24, 2026.