CVE-2026-23117

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23117", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.969Z", "datePublished": "2026-02-14T15:09:49.188Z", "dateUpdated": "2026-11-05T21:23:17.769Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:00:27.366Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: add missing ice_deinit_hw() in devlink reinit path\n\ndevlink-reload results in ice_init_hw failed error, and then removing\nthe ice driver causes a NULL pointer dereference.\n\n[ +0.102213] ice 0000:ca:00.0: ice_init_hw failed: -16\n...\n[ +0.000001] Call Trace:\n[ +0.000003] <TASK>\n[ +0.000006] ice_unload+0x8f/0x100 [ice]\n[ +0.000081] ice_remove+0xba/0x300 [ice]\n\nCommit 1390b8b3d2be (\"ice: remove duplicate call to ice_deinit_hw() on\nerror paths\") removed ice_deinit_hw() from ice_deinit_dev(). As a result\nice_devlink_reinit_down() no longer calls ice_deinit_hw(), but\nice_devlink_reinit_up() still calls ice_init_hw(). Since the control\nqueues are not uninitialized, ice_init_hw() fails with -EBUSY.\n\nAdd ice_deinit_hw() to ice_devlink_reinit_down() to correspond with\nice_init_hw() in ice_devlink_reinit_up()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/devlink/devlink.c"], "versions": [{"version": "c91eee346089e4d287d5a111719e57cac605275e", "lessThan": "a3d99e2fbf01446d31a0d0dfc46444e915a1f6d4", "status": "affected", "versionType": "git"}, {"version": "1390b8b3d2bef9bfbb852fc735430798bfca36e7", "lessThan": "42fb5f3deb582cb96440e4683745017dbabb83d6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/devlink/devlink.c"], "versions": [{"version": "6.18.2", "lessThan": "6.18.8", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.2", "versionEndExcluding": "6.18.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a3d99e2fbf01446d31a0d0dfc46444e915a1f6d4"}, {"url": "https://git.kernel.org/stable/c/42fb5f3deb582cb96440e4683745017dbabb83d6"}], "title": "ice: add missing ice_deinit_hw() in devlink reinit path", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23117", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:19:45.390625Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:23:17.769Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23117", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:19:45.390625Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:19:46.971Z"}}], "cna": {"title": "ice: add missing ice_deinit_hw() in devlink reinit path", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c91eee346089e4d287d5a111719e57cac605275e", "lessThan": "a3d99e2fbf01446d31a0d0dfc46444e915a1f6d4", "versionType": "git"}, {"status": "affected", "version": "1390b8b3d2bef9bfbb852fc735430798bfca36e7", "lessThan": "42fb5f3deb582cb96440e4683745017dbabb83d6", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/ice/devlink/devlink.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18.2", "lessThan": "6.18.8", "versionType": "semver"}], "programFiles": ["drivers/net/ethernet/intel/ice/devlink/devlink.c"], "defaultStatus": "unaffected"}], "references": [{"url": "https://git.kernel.org/stable/c/a3d99e2fbf01446d31a0d0dfc46444e915a1f6d4"}, {"url": "https://git.kernel.org/stable/c/42fb5f3deb582cb96440e4683745017dbabb83d6"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: add missing ice_deinit_hw() in devlink reinit path\n\ndevlink-reload results in ice_init_hw failed error, and then removing\nthe ice driver causes a NULL pointer dereference.\n\n[ +0.102213] ice 0000:ca:00.0: ice_init_hw failed: -16\n...\n[ +0.000001] Call Trace:\n[ +0.000003] <TASK>\n[ +0.000006] ice_unload+0x8f/0x100 [ice]\n[ +0.000081] ice_remove+0xba/0x300 [ice]\n\nCommit 1390b8b3d2be (\"ice: remove duplicate call to ice_deinit_hw() on\nerror paths\") removed ice_deinit_hw() from ice_deinit_dev(). As a result\nice_devlink_reinit_down() no longer calls ice_deinit_hw(), but\nice_devlink_reinit_up() still calls ice_init_hw(). Since the control\nqueues are not uninitialized, ice_init_hw() fails with -EBUSY.\n\nAdd ice_deinit_hw() to ice_devlink_reinit_down() to correspond with\nice_init_hw() in ice_devlink_reinit_up()."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.8", "versionStartIncluding": "6.18.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:00:27.366Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23117", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:23:17.769Z", "dateReserved": "2026-01-13T15:37:45.969Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-02-14T15:09:49.188Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ice/devlink/devlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a3d99e2fbf01446d31a0d0dfc46444e915a1f6d4", "status": "affected", "version": "c91eee346089e4d287d5a111719e57cac605275e", "versionType": "git"}, {"lessThan": "42fb5f3deb582cb96440e4683745017dbabb83d6", "status": "affected", "version": "1390b8b3d2bef9bfbb852fc735430798bfca36e7", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ice/devlink/devlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.18.8", "status": "affected", "version": "6.18.2", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C68BE47E-77B0-441F-9B37-B225FFDB0D5D", "versionEndExcluding": "6.18.8", "versionStartIncluding": "6.18.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: add missing ice_deinit_hw() in devlink reinit path\n\ndevlink-reload results in ice_init_hw failed error, and then removing\nthe ice driver causes a NULL pointer dereference.\n\n[ +0.102213] ice 0000:ca:00.0: ice_init_hw failed: -16\n...\n[ +0.000001] Call Trace:\n[ +0.000003] <TASK>\n[ +0.000006] ice_unload+0x8f/0x100 [ice]\n[ +0.000081] ice_remove+0xba/0x300 [ice]\n\nCommit 1390b8b3d2be (\"ice: remove duplicate call to ice_deinit_hw() on\nerror paths\") removed ice_deinit_hw() from ice_deinit_dev(). As a result\nice_devlink_reinit_down() no longer calls ice_deinit_hw(), but\nice_devlink_reinit_up() still calls ice_init_hw(). Since the control\nqueues are not uninitialized, ice_init_hw() fails with -EBUSY.\n\nAdd ice_deinit_hw() to ice_devlink_reinit_down() to correspond with\nice_init_hw() in ice_devlink_reinit_up()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nice: a\u00f1adir la llamada faltante a ice_deinit_hw() en la ruta de reinicio de devlink\n\ndevlink-reload resulta en un error de fallo de ice_init_hw, y luego la eliminaci\u00f3n del controlador ice causa una desreferencia de puntero NULL.\n\n[ +0.102213] ice 0000:ca:00.0: ice_init_hw fall\u00f3: -16\n...\n[ +0.000001] Traza de Llamadas:\n[ +0.000003] \n[ +0.000006] ice_unload+0x8f/0x100 [ice]\n[ +0.000081] ice_remove+0xba/0x300 [ice]\n\nEl commit 1390b8b3d2be ('ice: eliminar llamada duplicada a ice_deinit_hw() en rutas de error') elimin\u00f3 ice_deinit_hw() de ice_deinit_dev(). Como resultado, ice_devlink_reinit_down() ya no llama a ice_deinit_hw(), pero ice_devlink_reinit_up() todav\u00eda llama a ice_init_hw(). Dado que las colas de control no est\u00e1n desinicializadas, ice_init_hw() falla con -EBUSY.\n\nA\u00f1adir ice_deinit_hw() a ice_devlink_reinit_down() para corresponder con ice_init_hw() en ice_devlink_reinit_up()."}], "id": "CVE-2026-23117", "lastModified": "2026-11-05T22:18:02.907", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23117", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:19:45.390625Z", "version": "2.0.3"}}]}, "published": "2026-02-14T15:16:06.830", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/42fb5f3deb582cb96440e4683745017dbabb83d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a3d99e2fbf01446d31a0d0dfc46444e915a1f6d4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ice: add missing ice_deinit_hw() in devlink reinit path", "id": "2439875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439875"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nice: add missing ice_deinit_hw() in devlink reinit path\ndevlink-reload results in ice_init_hw failed error, and then removing\nthe ice driver causes a NULL pointer dereference.\n[ +0.102213] ice 0000:ca:00.0: ice_init_hw failed: -16\n...\n[ +0.000001] Call Trace:\n[ +0.000003] <TASK>\n[ +0.000006] ice_unload+0x8f/0x100 [ice]\n[ +0.000081] ice_remove+0xba/0x300 [ice]\nCommit 1390b8b3d2be (\"ice: remove duplicate call to ice_deinit_hw() on\nerror paths\") removed ice_deinit_hw() from ice_deinit_dev(). As a result\nice_devlink_reinit_down() no longer calls ice_deinit_hw(), but\nice_devlink_reinit_up() still calls ice_init_hw(). Since the control\nqueues are not uninitialized, ice_init_hw() fails with -EBUSY.\nAdd ice_deinit_hw() to ice_devlink_reinit_down() to correspond with\nice_init_hw() in ice_devlink_reinit_up()."], "name": "CVE-2026-23117", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23117\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23117\nhttps://lore.kernel.org/linux-cve-announce/2026021406-CVE-2026-23117-0b29@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c91eee346089e4d287d5a111719e57cac605275e,a3d99e2fbf01446d31a0d0dfc46444e915a1f6d4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1390b8b3d2bef9bfbb852fc735430798bfca36e7,42fb5f3deb582cb96440e4683745017dbabb83d6)"}}], "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.2,6.18.8)"}}], "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-17T19:44:27.904903+00:00", "value": {"mitigation_remediation": ["Apply the latest Linux kernel version that includes the fix for the missing ice_deinit_hw call in the devlink reinit path.", "Reboot the system after applying the kernel update.", "Avoid unloading the ice driver or performing devlink reload operations until the kernel is patched."], "summary": {"action": "Patch kernel", "impact": "Denial of Service via kernel crash"}, "threat_synthesis": {"affected_systems": "Linux kernel versions 6.19 release candidates rc1 through rc6 are affected by the code path flaw. The bug was fixed by commit 1390b8b3d2be, which restores the missing deinitialization call in the reinit down path.", "description_and_impact": "The vulnerability arises from a missing call to ice_deinit_hw during the devlink reinitialization path. When a devlink reload fails, subsequent unloading of the ice driver dereferences a NULL pointer, causing a kernel panic and system reboot. This results in a denial\u2011of\u2011service impact to the affected host.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1% and the vulnerability is not listed in the KEV catalog, suggesting a low likelihood of exploitation. Exploitation requires the ability to unload or reload the ice driver, a privileged operation, so the attack surface is limited. Overall, the risk is moderate but unlikely to be widely exploited."}}}}, "created": "2026-02-16T12:01:47.579165+00:00", "updated": "2026-04-17T19:45:25.904380+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}