Listen to this Post
How the CVE works:
In the Linux kernel’s ice Ethernet driver, a NULL pointer dereference occurs during a PCIe function reset triggered via sysfs. When RDMA support is not loaded, the driver’s auxiliary device data structure (cdev_info) remains uninitialized and NULL. During reset preparation, ice_prepare_for_reset() calls ice_unplug_aux_dev(). This function attempts to access pf->cdev_info->adev but does not check if pf->cdev_info itself is NULL. Dereferencing this NULL pointer causes a kernel oops and system crash. The vulnerability is exploitable by any user with write access to the sysfs reset attribute, typically requiring local access. The fix introduces a flag (pf->aux_dev_created) to track successful auxiliary device creation, ensuring proper NULL checks before access.
Platform: Linux kernel ice
Version: Affected kernel versions
Vulnerability: NULL pointer dereference
Severity: Critical
Date: 2025-09-16
Prediction: Patched 2025-09-16
What Undercode Say:
Analytics:
Bash command: echo 1 > /sys/class/net//device/reset
Code issue: ice_unplug_aux_dev() dereferences pf->cdev_info when NULL.
How Exploit:
Local write to sysfs reset triggers kernel panic.
Protection from this CVE
Apply kernel patch introducing aux_dev_created flag.
Impact:
Kernel crash, denial of service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
