{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23166", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.981Z", "datePublished": "2026-02-14T16:01:30.059Z", "dateUpdated": "2026-05-11T22:01:36.058Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:01:36.058Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix NULL pointer dereference in ice_vsi_set_napi_queues\n\nAdd NULL pointer checks in ice_vsi_set_napi_queues() to prevent crashes\nduring resume from suspend when rings[q_idx]->q_vector is NULL.\n\nTested adaptor:\n60:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller E810-XXV for SFP [8086:159b] (rev 02)\n Subsystem: Intel Corporation Ethernet Network Adapter E810-XXV-2 [8086:4003]\n\nSR-IOV state: both disabled and enabled can reproduce this issue.\n\nkernel version: v6.18\n\nReproduce steps:\nBoot up and execute suspend like systemctl suspend or rtcwake.\n\nLog:\n<1>[ 231.443607] BUG: kernel NULL pointer dereference, address: 0000000000000040\n<1>[ 231.444052] #PF: supervisor read access in kernel mode\n<1>[ 231.444484] #PF: error_code(0x0000) - not-present page\n<6>[ 231.444913] PGD 0 P4D 0\n<4>[ 231.445342] Oops: Oops: 0000 [#1] SMP NOPTI\n<4>[ 231.446635] RIP: 0010:netif_queue_set_napi+0xa/0x170\n<4>[ 231.447067] Code: 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 c9 74 0b <48> 83 79 30 00 0f 84 39 01 00 00 55 41 89 d1 49 89 f8 89 f2 48 89\n<4>[ 231.447513] RSP: 0018:ffffcc780fc078c0 EFLAGS: 00010202\n<4>[ 231.447961] RAX: ffff8b848ca30400 RBX: ffff8b848caf2028 RCX: 0000000000000010\n<4>[ 231.448443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b848dbd4000\n<4>[ 231.448896] RBP: ffffcc780fc078e8 R08: 0000000000000000 R09: 0000000000000000\n<4>[ 231.449345] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001\n<4>[ 231.449817] R13: ffff8b848dbd4000 R14: ffff8b84833390c8 R15: 0000000000000000\n<4>[ 231.450265] FS: 00007c7b29e9d740(0000) GS:ffff8b8c068e2000(0000) knlGS:0000000000000000\n<4>[ 231.450715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n<4>[ 231.451179] CR2: 0000000000000040 CR3: 000000030626f004 CR4: 0000000000f72ef0\n<4>[ 231.451629] PKRU: 55555554\n<4>[ 231.452076] Call Trace:\n<4>[ 231.452549] <TASK>\n<4>[ 231.452996] ? ice_vsi_set_napi_queues+0x4d/0x110 [ice]\n<4>[ 231.453482] ice_resume+0xfd/0x220 [ice]\n<4>[ 231.453977] ? __pfx_pci_pm_resume+0x10/0x10\n<4>[ 231.454425] pci_pm_resume+0x8c/0x140\n<4>[ 231.454872] ? __pfx_pci_pm_resume+0x10/0x10\n<4>[ 231.455347] dpm_run_callback+0x5f/0x160\n<4>[ 231.455796] ? dpm_wait_for_superior+0x107/0x170\n<4>[ 231.456244] device_resume+0x177/0x270\n<4>[ 231.456708] dpm_resume+0x209/0x2f0\n<4>[ 231.457151] dpm_resume_end+0x15/0x30\n<4>[ 231.457596] suspend_devices_and_enter+0x1da/0x2b0\n<4>[ 231.458054] enter_state+0x10e/0x570\n\nAdd defensive checks for both the ring pointer and its q_vector\nbefore dereferencing, allowing the system to resume successfully even when\nq_vectors are unmapped."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/ice_lib.c"], "versions": [{"version": "2a5dc090b92cfa5270e20056074241c6db5c9cdd", "lessThan": "d75c7b7c3c2b8e3569043099e6bdcefc983856c5", "status": "affected", "versionType": "git"}, {"version": "2a5dc090b92cfa5270e20056074241c6db5c9cdd", "lessThan": "36126ddbe924727add05a594dedf230d3b575e4d", "status": "affected", "versionType": "git"}, {"version": "2a5dc090b92cfa5270e20056074241c6db5c9cdd", "lessThan": "9bb30be4d89ff9a8d7ab1aa0eb2edaca83431f85", "status": "affected", "versionType": "git"}, {"version": "2285c2faef19ee08a6bd6754f4c3ec07dceb2889", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/ice_lib.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.69", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.9", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.69"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d75c7b7c3c2b8e3569043099e6bdcefc983856c5"}, {"url": "https://git.kernel.org/stable/c/36126ddbe924727add05a594dedf230d3b575e4d"}, {"url": "https://git.kernel.org/stable/c/9bb30be4d89ff9a8d7ab1aa0eb2edaca83431f85"}], "title": "ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20B10614-CE0D-494A-9FEA-F01A6985C9B7", "versionEndExcluding": "6.11", "versionStartIncluding": "6.10.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD81BD2F-4651-47F4-8CE3-D4217B34D3F1", "versionEndExcluding": "6.12.69", "versionStartIncluding": "6.11.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "171CFCB2-8F49-4F9E-8A67-FAC6BF45B5A2", "versionEndExcluding": "6.18.9", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*", "matchCriteriaId": "4770BA57-3F3F-493B-8608-EC3B25254949", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*", "matchCriteriaId": "DE5298B3-04B4-4F3E-B186-01A58B5C75A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix NULL pointer dereference in ice_vsi_set_napi_queues\n\nAdd NULL pointer checks in ice_vsi_set_napi_queues() to prevent crashes\nduring resume from suspend when rings[q_idx]->q_vector is NULL.\n\nTested adaptor:\n60:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller E810-XXV for SFP [8086:159b] (rev 02)\n Subsystem: Intel Corporation Ethernet Network Adapter E810-XXV-2 [8086:4003]\n\nSR-IOV state: both disabled and enabled can reproduce this issue.\n\nkernel version: v6.18\n\nReproduce steps:\nBoot up and execute suspend like systemctl suspend or rtcwake.\n\nLog:\n<1>[ 231.443607] BUG: kernel NULL pointer dereference, address: 0000000000000040\n<1>[ 231.444052] #PF: supervisor read access in kernel mode\n<1>[ 231.444484] #PF: error_code(0x0000) - not-present page\n<6>[ 231.444913] PGD 0 P4D 0\n<4>[ 231.445342] Oops: Oops: 0000 [#1] SMP NOPTI\n<4>[ 231.446635] RIP: 0010:netif_queue_set_napi+0xa/0x170\n<4>[ 231.447067] Code: 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 c9 74 0b <48> 83 79 30 00 0f 84 39 01 00 00 55 41 89 d1 49 89 f8 89 f2 48 89\n<4>[ 231.447513] RSP: 0018:ffffcc780fc078c0 EFLAGS: 00010202\n<4>[ 231.447961] RAX: ffff8b848ca30400 RBX: ffff8b848caf2028 RCX: 0000000000000010\n<4>[ 231.448443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b848dbd4000\n<4>[ 231.448896] RBP: ffffcc780fc078e8 R08: 0000000000000000 R09: 0000000000000000\n<4>[ 231.449345] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001\n<4>[ 231.449817] R13: ffff8b848dbd4000 R14: ffff8b84833390c8 R15: 0000000000000000\n<4>[ 231.450265] FS: 00007c7b29e9d740(0000) GS:ffff8b8c068e2000(0000) knlGS:0000000000000000\n<4>[ 231.450715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n<4>[ 231.451179] CR2: 0000000000000040 CR3: 000000030626f004 CR4: 0000000000f72ef0\n<4>[ 231.451629] PKRU: 55555554\n<4>[ 231.452076] Call Trace:\n<4>[ 231.452549] <TASK>\n<4>[ 231.452996] ? ice_vsi_set_napi_queues+0x4d/0x110 [ice]\n<4>[ 231.453482] ice_resume+0xfd/0x220 [ice]\n<4>[ 231.453977] ? __pfx_pci_pm_resume+0x10/0x10\n<4>[ 231.454425] pci_pm_resume+0x8c/0x140\n<4>[ 231.454872] ? __pfx_pci_pm_resume+0x10/0x10\n<4>[ 231.455347] dpm_run_callback+0x5f/0x160\n<4>[ 231.455796] ? dpm_wait_for_superior+0x107/0x170\n<4>[ 231.456244] device_resume+0x177/0x270\n<4>[ 231.456708] dpm_resume+0x209/0x2f0\n<4>[ 231.457151] dpm_resume_end+0x15/0x30\n<4>[ 231.457596] suspend_devices_and_enter+0x1da/0x2b0\n<4>[ 231.458054] enter_state+0x10e/0x570\n\nAdd defensive checks for both the ring pointer and its q_vector\nbefore dereferencing, allowing the system to resume successfully even when\nq_vectors are unmapped."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nice: Corrige la desreferencia de puntero NULL en ice_vsi_set_napi_queues\n\nA\u00f1ade comprobaciones de puntero NULL en ice_vsi_set_napi_queues() para evitar fallos durante la reanudaci\u00f3n desde la suspensi\u00f3n cuando rings[q_idx]-&gt;q_vector es NULL.\n\nAdaptador probado:\n60:00.0 Controlador Ethernet [0200]: Intel Corporation Ethernet Controller E810-XXV para SFP [8086:159b] (rev 02)\n Subsistema: Intel Corporation Ethernet Network Adapter E810-XXV-2 [8086:4003]\n\nEstado de SR-IOV: tanto deshabilitado como habilitado pueden reproducir este problema.\n\nversi\u00f3n del kernel: v6.18\n\nPasos para reproducir:\nArrancar y ejecutar la suspensi\u00f3n como systemctl suspend o rtcwake.\n\nRegistro:\n&lt;1&gt;[ 231.443607] BUG: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000040\n&lt;1&gt;[ 231.444052] #PF: acceso de lectura de supervisor en modo kernel\n&lt;1&gt;[ 231.444484] #PF: c\u00f3digo_de_error(0x0000) - p\u00e1gina no presente\n&lt;6&gt;[ 231.444913] PGD 0 P4D 0\n&lt;4&gt;[ 231.445342] Oops: Oops: 0000 [#1] SMP NOPTI\n&lt;4&gt;[ 231.446635] RIP: 0010:netif_queue_set_napi+0xa/0x170\n&lt;4&gt;[ 231.447067] Code: 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 c9 74 0b &lt;48&gt; 83 79 30 00 0f 84 39 01 00 00 55 41 89 d1 49 89 f8 89 f2 48 89\n&lt;4&gt;[ 231.447513] RSP: 0018:ffffcc780fc078c0 EFLAGS: 00010202\n&lt;4&gt;[ 231.447961] RAX: ffff8b848ca30400 RBX: ffff8b848caf2028 RCX: 0000000000000010\n&lt;4&gt;[ 231.448443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b848dbd4000\n&lt;4&gt;[ 231.448896] RBP: ffffcc780fc078e8 R08: 0000000000000000 R09: 0000000000000000\n&lt;4&gt;[ 231.449345] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001\n&lt;4&gt;[ 231.449817] R13: ffff8b848dbd4000 R14: ffff8b84833390c8 R15: 0000000000000000\n&lt;4&gt;[ 231.450265] FS: 00007c7b29e9d740(0000) GS:ffff8b8c068e2000(0000) knlGS:0000000000000000\n&lt;4&gt;[ 231.450715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n&lt;4&gt;[ 231.451179] CR2: 0000000000000040 CR3: 000000030626f004 CR4: 0000000000f72ef0\n&lt;4&gt;[ 231.451629] PKRU: 55555554\n&lt;4&gt;[ 231.452076] Traza de llamada:\n&lt;4&gt;[ 231.452549] \n&lt;4&gt;[ 231.452996] ? ice_vsi_set_napi_queues+0x4d/0x110 [ice]\n&lt;4&gt;[ 231.453482] ice_resume+0xfd/0x220 [ice]\n&lt;4&gt;[ 231.453977] ? __pfx_pci_pm_resume+0x10/0x10\n&lt;4&gt;[ 231.454425] pci_pm_resume+0x8c/0x140\n&lt;4&gt;[ 231.454872] ? __pfx_pci_pm_resume+0x10/0x10\n&lt;4&gt;[ 231.455347] dpm_run_callback+0x5f/0x160\n&lt;4&gt;[ 231.455796] ? dpm_wait_for_superior+0x107/0x170\n&lt;4&gt;[ 231.456244] device_resume+0x177/0x270\n&lt;4&gt;[ 231.456708] dpm_resume+0x209/0x2f0\n&lt;4&gt;[ 231.457151] dpm_resume_end+0x15/0x30\n&lt;4&gt;[ 231.457596] suspend_devices_and_enter+0x1da/0x2b0\n&lt;4&gt;[ 231.458054] enter_state+0x10e/0x570\n\nA\u00f1ade comprobaciones defensivas tanto para el puntero del anillo como para su q_vector antes de desreferenciar, permitiendo que el sistema se reanude con \u00e9xito incluso cuando los q_vectors no est\u00e1n mapeados."}], "id": "CVE-2026-23166", "lastModified": "2026-03-18T15:02:35.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-02-14T16:15:56.797", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/36126ddbe924727add05a594dedf230d3b575e4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9bb30be4d89ff9a8d7ab1aa0eb2edaca83431f85"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d75c7b7c3c2b8e3569043099e6bdcefc983856c5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues", "id": "2439891", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439891"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nice: Fix NULL pointer dereference in ice_vsi_set_napi_queues\nAdd NULL pointer checks in ice_vsi_set_napi_queues() to prevent crashes\nduring resume from suspend when rings[q_idx]->q_vector is NULL.\nTested adaptor:\n60:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller E810-XXV for SFP [8086:159b] (rev 02)\nSubsystem: Intel Corporation Ethernet Network Adapter E810-XXV-2 [8086:4003]\nSR-IOV state: both disabled and enabled can reproduce this issue.\nkernel version: v6.18\nReproduce steps:\nBoot up and execute suspend like systemctl suspend or rtcwake.\nLog:\n<1>[ 231.443607] BUG: kernel NULL pointer dereference, address: 0000000000000040\n<1>[ 231.444052] #PF: supervisor read access in kernel mode\n<1>[ 231.444484] #PF: error_code(0x0000) - not-present page\n<6>[ 231.444913] PGD 0 P4D 0\n<4>[ 231.445342] Oops: Oops: 0000 [#1] SMP NOPTI\n<4>[ 231.446635] RIP: 0010:netif_queue_set_napi+0xa/0x170\n<4>[ 231.447067] Code: 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 c9 74 0b <48> 83 79 30 00 0f 84 39 01 00 00 55 41 89 d1 49 89 f8 89 f2 48 89\n<4>[ 231.447513] RSP: 0018:ffffcc780fc078c0 EFLAGS: 00010202\n<4>[ 231.447961] RAX: ffff8b848ca30400 RBX: ffff8b848caf2028 RCX: 0000000000000010\n<4>[ 231.448443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b848dbd4000\n<4>[ 231.448896] RBP: ffffcc780fc078e8 R08: 0000000000000000 R09: 0000000000000000\n<4>[ 231.449345] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001\n<4>[ 231.449817] R13: ffff8b848dbd4000 R14: ffff8b84833390c8 R15: 0000000000000000\n<4>[ 231.450265] FS: 00007c7b29e9d740(0000) GS:ffff8b8c068e2000(0000) knlGS:0000000000000000\n<4>[ 231.450715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n<4>[ 231.451179] CR2: 0000000000000040 CR3: 000000030626f004 CR4: 0000000000f72ef0\n<4>[ 231.451629] PKRU: 55555554\n<4>[ 231.452076] Call Trace:\n<4>[ 231.452549] <TASK>\n<4>[ 231.452996] ? ice_vsi_set_napi_queues+0x4d/0x110 [ice]\n<4>[ 231.453482] ice_resume+0xfd/0x220 [ice]\n<4>[ 231.453977] ? __pfx_pci_pm_resume+0x10/0x10\n<4>[ 231.454425] pci_pm_resume+0x8c/0x140\n<4>[ 231.454872] ? __pfx_pci_pm_resume+0x10/0x10\n<4>[ 231.455347] dpm_run_callback+0x5f/0x160\n<4>[ 231.455796] ? dpm_wait_for_superior+0x107/0x170\n<4>[ 231.456244] device_resume+0x177/0x270\n<4>[ 231.456708] dpm_resume+0x209/0x2f0\n<4>[ 231.457151] dpm_resume_end+0x15/0x30\n<4>[ 231.457596] suspend_devices_and_enter+0x1da/0x2b0\n<4>[ 231.458054] enter_state+0x10e/0x570\nAdd defensive checks for both the ring pointer and its q_vector\nbefore dereferencing, allowing the system to resume successfully even when\nq_vectors are unmapped."], "name": "CVE-2026-23166", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23166\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23166\nhttps://lore.kernel.org/linux-cve-announce/2026021419-CVE-2026-23166-c1fa@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a5dc090b92cfa5270e20056074241c6db5c9cdd,d75c7b7c3c2b8e3569043099e6bdcefc983856c5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a5dc090b92cfa5270e20056074241c6db5c9cdd,36126ddbe924727add05a594dedf230d3b575e4d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a5dc090b92cfa5270e20056074241c6db5c9cdd,9bb30be4d89ff9a8d7ab1aa0eb2edaca83431f85)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "2285c2faef19ee08a6bd6754f4c3ec07dceb2889"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.69,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.9,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19,*]"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-17T19:31:10.460327+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that includes the ice driver patch (e.g., kernels 6.11, 6.19 rc7, and later releases).", "Recompile the driver with the latest upstream source if the distribution\u2019s kernel package is not sufficient.", "In the interim, avoid using suspend or resume operations on affected hardware until the patch is applied."], "summary": {"action": "Apply Patch", "impact": "Kernel Crash (Denial of Service)"}, "threat_synthesis": {"affected_systems": "The affected component is the Linux kernel\u2019s ice driver for Intel Ethernet controllers, particularly the Intel E810 series. Versions of the kernel that include the robustness change to ice_vsi_set_napi_queues are required; the bug is known to exist in kernel releases 6.11, 6.19 releases candidates through rc7, and has been reproduced on a 6.18 kernel. Addressing the issue requires the patched kernel from the official upstream code base.", "description_and_impact": "The vulnerability is a NULL pointer dereference in the ice driver\u2019s ice_vsi_set_napi_queues function, which occurs during system resume when a ring\u2019s q_vector pointer is unset. This bug causes the kernel to Oops and crash, resulting in a denial\u2011of\u2011service condition. The weakness is identified as CWE\u2011476, a classic null\u2011pointer dereference, and does not provide direct code execution or privilege escalation. The crash is triggered by a suspend/resume cycle, which an attacker can initiate locally on the machine. The impact is confined to the kernel and results in an immediate system reboot, but does not expose user data or remote control.", "risk_and_exploitability": "The CVSS score is 5.5, indicating moderate severity. The EPSS score is below 1\u202f%, implying a very low likelihood of exploitation in the wild. The bug is not listed in the CISA KEV catalog. Exploitation requires the ability to trigger a suspend or rtcwake command, meaning a local privileged user can simply reboot the system. The attack vector is local and results solely in a denial of service; no data leakage or persistent compromise is enabled."}}}}, "created": "2026-02-16T09:44:24.662788+00:00", "updated": "2026-04-17T19:45:25.884016+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}