CVE-2026-97978: eth: ice: don't dereference pointers from TP_printk()
In the Linux kernel, the following vulnerability has been resolved:
eth: ice: don't dereference pointers from TPprintk()
After forwarding net-next during the v7.3 merge window we started seeing:
TRACE EVENT ERROR: Event icetxdimwork has double dereference in TPprintk: REC->qvector->tx.txring->qindex WARNING: kernel/trace/traceevents.c:420 at testdoubledereference.cold+0x39/0x4b
this is due to extra checks added in tracing subsystem in commit b5cc230af5e5 ("tracing: Warn when an event dereferences a pointer in TPprintk()").
Printing happens long after the event was recorded, by which point the pointers may be invalid (the ring or the dim instance). Copy the eight scalars into the event instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Copy the eight scalar values into the ice_tx_dim_work event when it is recorded, and have TP_printk use those scalars instead of dereferencing REC->q_vector->tx.tx_ring->q_index or other pointers.
Linux kernel eth: ice trace event ice_tx_dim_work TP_printk pointer dereferences = eight scalar fields copied into the event
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The issue involves the ice_tx_dim_work trace event and occurs when its TP_printk() expression dereferences pointers after the event has been recorded. The referenced ring or DIM instance may no longer be valid when tracing later formats the event.
How can I determine whether a system is encountering this problem?
Affected systems may report a trace event error stating that ice_tx_dim_work has a double dereference in TP_printk, referencing REC->q_vector->tx.tx_ring->q_index. The report may also include a warning from kernel/trace/trace_events.c at test_double_dereference.cold.
What does the fix change?
The fix avoids dereferencing recorded pointers from TP_printk() by copying eight scalar values into the trace event instead. This ensures formatting does not depend on the continued validity of the ring or DIM pointers.