CVE-2026-23210

ice: Fix PTP NULL pointer dereference during VSI rebuild

4.7 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix PTP NULL pointer dereference during VSI rebuild

Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings.

The sequence was:

ice_ptp_prepare_for_reset() cancels PTP work
ice_ptp_rebuild() immediately queues PTP work
VSI rebuild happens AFTER ice_ptp_rebuild()
PTP work runs and accesses NULL vsi->rx_rings

Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild().

Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY.

Error log: [ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: error_code(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=CPU_OUT_OF_SPEC [ 121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] <TASK> [ 121.393055] ice_ptp_periodic_work+0x69/0x180 [ice] [ 121.393202] kthread_worker_fn+0xa2/0x260 [ 121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice] [ 121.393359] ? __pfx_kthread_worker_fn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? __pfx_kthread+0x10/0x10 [ 121.393393] ret_from_fork+0x273/0x2b0 [ 121.393407] ? __pfx_kthread+0x10/0x10 [ 121.393417] ret_from_fork_asm+0x1a/0x30 [ 121.393432] </TASK>

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.10%Up 0.1 points since Feb 15, 2026

What each source reports

NVD Score used 4.7

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix PTP NULL pointer dereference during VSI rebuild

Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings.

The sequence was:

ice_ptp_prepare_for_reset() cancels PTP work
ice_ptp_rebuild() immediately queues PTP work
VSI rebuild happens AFTER ice_ptp_rebuild()
PTP work runs and accesses NULL vsi->rx_rings

Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild().

Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY.

Record: CVE-2026-23210
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476, CWE-362
Updated: 2026-11-02

CVE List No score

ice: Fix PTP NULL pointer dereference during VSI rebuild

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix PTP NULL pointer dereference during VSI rebuild

Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings.

The sequence was:

ice_ptp_prepare_for_reset() cancels PTP work
ice_ptp_rebuild() immediately queues PTP work
VSI rebuild happens AFTER ice_ptp_rebuild()
PTP work runs and accesses NULL vsi->rx_rings

Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild().

Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY.

Record: CVE-2026-23210
Weakness: CWE-362
Updated: 2026-11-02

EUVDEUVD-2026-5836 No score

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix PTP NULL pointer dereference during VSI rebuild

Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings.

The sequence was:

ice_ptp_prepare_for_reset() cancels PTP work
ice_ptp_rebuild() immediately queues PTP work
VSI rebuild happens AFTER ice_ptp_rebuild()
PTP work runs and accesses NULL vsi->rx_rings

Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild().

Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY.

Record: EUVD-2026-5836
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7w83-2rgm-8vj5 4.7

In the Linux kernel, the following vulnerability has been resolved: ice: Fix PTP NULL pointer...

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix PTP NULL pointer dereference during VSI rebuild

Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings.

The sequence was:

ice_ptp_prepare_for_reset() cancels PTP work
ice_ptp_rebuild() immediately queues PTP work
VSI rebuild happens AFTER ice_ptp_rebuild()
PTP work runs and accesses NULL vsi->rx_rings

Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild().

Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY.

Record: GHSA-7w83-2rgm-8vj5
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-362, CWE-476
Updated: 2026-11-02

OSVBELL-CVE-2026-23210 4.7

Record: BELL-CVE-2026-23210
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-23210 4.7

In the Linux kernel, the following vulnerability has been resolved: ice: Fix PTP NULL pointer dereference during VSI rebuild Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings. The sequence was: 1. ice_ptp_prepare_for_reset() cancels PTP work 2. ice_ptp_rebuild() immediately queues PTP work 3. VSI rebuild happens AFTER ice_ptp_rebuild() 4. PTP work runs and accesses NULL vsi->rx_rings Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild(). Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY. Error log: [ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: error_code(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=CPU_OUT_OF_SPEC [ 121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] <TASK> [ 121.393055] ice_ptp_periodic_work+0x69/0x180 [ice] [ 121.393202] kthread_worker_fn+0xa2/0x260 [ 121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice] [ 121.393359] ? __pfx_kthread_worker_fn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? __pfx_kthread+0x10/0x10 [ 121.393393] ret_from_fork+0x273/0x2b0 [ 121.393407] ? __pfx_kthread+0x10/0x10 [ 121.393417] ret_from_fork_asm+0x1a/0x30 [ 121.393432] </TASK>

Record: DEBIAN-CVE-2026-23210
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 25 moreShow less

OSVRHSA-2026:18134 8.7

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:18134
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:22334 7.3

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:22334
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Updated: 2026-11-02

OSVRHSA-2026:23224 8.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:23224
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:6570 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:6570
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:6570 7.5

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: Linux kernel (net/mlx5): Use-after-free in ECVF vports unload leads to denial of service (CVE-2025-38109)
kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210)
kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:6570
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-23210 4.7

Record: UBUNTU-CVE-2026-23210
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-04

OSVALSA-2026:18134 No score

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633)
kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)
kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)
kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)
kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)
kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202)
kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)
kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267)
kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275)
kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)
kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)
kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)
kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)
kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)
kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)
kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034)
kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)
kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210)
kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257)
kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320)
kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)
kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210)
kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2026:18134
Updated: 2026-11-02

OSVALSA-2026:6570 No score

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: Linux kernel (net/mlx5): Use-after-free in ECVF vports unload leads to denial of service (CVE-2025-38109)
kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210)
kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:6570
Updated: 2026-11-02

OSVCLSA-2026-1782155469 No score

kernel: Fix of 143 CVEs

ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}
tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}
mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}
cpuset: fix warning when disabling remote partition {CVE-2025-71142}
virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}
netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}
atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}
idpf: fix error handling in the init_task on load {CVE-2026-23017}
rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}
block: zero non-PI portion of auto integrity buffer {CVE-2026-23007}
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}
virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}
net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}
gfs2: Validate i_depth for exhash directories {CVE-2025-38710}
KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}
RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}
RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
scsi: qla2xxx: Validate sp before freeing associated memory {CVE-2025-71236}
net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}
drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}
iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}
net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}
ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003}
drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}
lib/buildid: use __kernel_read() for sleepable context {CVE-2026-23002}
scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}
net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
irqchip/imx-irqsteer: Handle runtime power management correctly {CVE-2024-42290}
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop {CVE-2026-23113}
net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}
ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
net: USB: Fix wrong-direction WARNING in plusb.c {CVE-2023-52742}
module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}
udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
net/mlx5: qos: Restrict RTNL area to avoid a lock cycle {CVE-2025-39947}
scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
nbd: don't allow reconnect after disconnect {CVE-2025-21731}
nfsd: check that server is running in unlock_filesystem {CVE-2026-22989}
af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}
netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286} -…

Record: CLSA-2026-1782155469
Updated: 2026-11-02

OSVCLSA-2026-1783791447 No score

kernel: Fix of 307 CVEs

gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
HID: betop: check shape of output reports {CVE-2023-53015}
mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
nbd: don't allow reconnect after disconnect {CVE-2025-21731}
openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
virtgpu: don't reset on shutdown {CVE-2025-38064}
xen/netfront: fix crash when removing device {CVE-2022-48969}
mptcp: do not fallback when OoO is present {CVE-2024-50185}
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
ext4: fix racy may inline data check in dio write {CVE-2023-52786}
drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
macsec: fix UAF bug for real_dev {CVE-2022-49390}
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
dlm: fix possible lkb_resource…

Record: CLSA-2026-1783791447
Updated: 2026-11-02

OSV No score

ice: Fix PTP NULL pointer dereference during VSI rebuild

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix PTP NULL pointer dereference during VSI rebuild

Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings.

The sequence was:

ice_ptp_prepare_for_reset() cancels PTP work
ice_ptp_rebuild() immediately queues PTP work
VSI rebuild happens AFTER ice_ptp_rebuild()
PTP work runs and accesses NULL vsi->rx_rings

Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild().

Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY.

Record: CVE-2026-23210
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20416-1 No score