CVE-2026-97978

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97978", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.208Z", "datePublished": "2026-09-25T10:23:15.831Z", "dateUpdated": "2026-10-21T12:53:56.446Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:53:56.446Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: ice: don't dereference pointers from TP_printk()\n\nAfter forwarding net-next during the v7.3 merge window we started\nseeing:\n\n TRACE EVENT ERROR: Event ice_tx_dim_work has double dereference in TP_printk: REC->q_vector->tx.tx_ring->q_index\n WARNING: kernel/trace/trace_events.c:420 at test_double_dereference.cold+0x39/0x4b\n\nthis is due to extra checks added in tracing subsystem in\ncommit b5cc230af5e5 (\"tracing: Warn when an event dereferences a pointer in TP_printk()\").\n\nPrinting happens long after the event was recorded, by which point\nthe pointers may be invalid (the ring or the dim instance).\nCopy the eight scalars into the event instead."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/ice_trace.h"], "versions": [{"version": "3089cf6d3caa1eb344aac05c875f4aeaf891552d", "lessThan": "385aa7dbc6af11d90a5dd1261dbe75950eb7ca93", "status": "affected", "versionType": "git"}, {"version": "3089cf6d3caa1eb344aac05c875f4aeaf891552d", "lessThan": "ae230874e3ba27e975a9bb21a6ffd05d6a2ea318", "status": "affected", "versionType": "git"}, {"version": "3089cf6d3caa1eb344aac05c875f4aeaf891552d", "lessThan": "0b0d2f9db2406aa541a8bc3737f4f4aae1cafde9", "status": "affected", "versionType": "git"}, {"version": "3089cf6d3caa1eb344aac05c875f4aeaf891552d", "lessThan": "c42db35518bb0eae42ec955520eee0aa94a4a6fe", "status": "affected", "versionType": "git"}, {"version": "3089cf6d3caa1eb344aac05c875f4aeaf891552d", "lessThan": "b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/ice_trace.h"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/385aa7dbc6af11d90a5dd1261dbe75950eb7ca93"}, {"url": "https://git.kernel.org/stable/c/ae230874e3ba27e975a9bb21a6ffd05d6a2ea318"}, {"url": "https://git.kernel.org/stable/c/0b0d2f9db2406aa541a8bc3737f4f4aae1cafde9"}, {"url": "https://git.kernel.org/stable/c/c42db35518bb0eae42ec955520eee0aa94a4a6fe"}, {"url": "https://git.kernel.org/stable/c/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b"}], "title": "eth: ice: don't dereference pointers from TP_printk()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ice/ice_trace.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "385aa7dbc6af11d90a5dd1261dbe75950eb7ca93", "status": "affected", "version": "3089cf6d3caa1eb344aac05c875f4aeaf891552d", "versionType": "git"}, {"lessThan": "ae230874e3ba27e975a9bb21a6ffd05d6a2ea318", "status": "affected", "version": "3089cf6d3caa1eb344aac05c875f4aeaf891552d", "versionType": "git"}, {"lessThan": "0b0d2f9db2406aa541a8bc3737f4f4aae1cafde9", "status": "affected", "version": "3089cf6d3caa1eb344aac05c875f4aeaf891552d", "versionType": "git"}, {"lessThan": "c42db35518bb0eae42ec955520eee0aa94a4a6fe", "status": "affected", "version": "3089cf6d3caa1eb344aac05c875f4aeaf891552d", "versionType": "git"}, {"lessThan": "b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b", "status": "affected", "version": "3089cf6d3caa1eb344aac05c875f4aeaf891552d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ice/ice_trace.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: ice: don't dereference pointers from TP_printk()\n\nAfter forwarding net-next during the v7.3 merge window we started\nseeing:\n\n TRACE EVENT ERROR: Event ice_tx_dim_work has double dereference in TP_printk: REC->q_vector->tx.tx_ring->q_index\n WARNING: kernel/trace/trace_events.c:420 at test_double_dereference.cold+0x39/0x4b\n\nthis is due to extra checks added in tracing subsystem in\ncommit b5cc230af5e5 (\"tracing: Warn when an event dereferences a pointer in TP_printk()\").\n\nPrinting happens long after the event was recorded, by which point\nthe pointers may be invalid (the ring or the dim instance).\nCopy the eight scalars into the event instead."}], "id": "CVE-2026-97978", "lastModified": "2026-10-21T13:21:18.243", "metrics": {}, "published": "2026-09-25T11:17:25.790", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b0d2f9db2406aa541a8bc3737f4f4aae1cafde9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/385aa7dbc6af11d90a5dd1261dbe75950eb7ca93"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae230874e3ba27e975a9bb21a6ffd05d6a2ea318"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c42db35518bb0eae42ec955520eee0aa94a4a6fe"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: eth: ice: don't dereference pointers from TP_printk()", "id": "2541217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541217"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\neth: ice: don't dereference pointers from TP_printk()\nAfter forwarding net-next during the v7.3 merge window we started\nseeing:\nTRACE EVENT ERROR: Event ice_tx_dim_work has double dereference in TP_printk: REC->q_vector->tx.tx_ring->q_index\nWARNING: kernel/trace/trace_events.c:420 at test_double_dereference.cold+0x39/0x4b\nthis is due to extra checks added in tracing subsystem in\ncommit b5cc230af5e5 (\"tracing: Warn when an event dereferences a pointer in TP_printk()\").\nPrinting happens long after the event was recorded, by which point\nthe pointers may be invalid (the ring or the dim instance).\nCopy the eight scalars into the event instead.", "A flaw was found in the Linux kernel's Intel Ethernet driver (ice). Event tracing routines dereferenced internal data pointers when formatting log messages instead of capturing the necessary values when the event was recorded. A local user with administrative access or tracing privileges could trigger an invalid pointer access if the referenced network structures are freed before trace messages are displayed, resulting in a Denial of Service (DoS) via a kernel crash."], "name": "CVE-2026-97978", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97978\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97978\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97978.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3089cf6d3caa1eb344aac05c875f4aeaf891552d,ae230874e3ba27e975a9bb21a6ffd05d6a2ea318)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3089cf6d3caa1eb344aac05c875f4aeaf891552d,0b0d2f9db2406aa541a8bc3737f4f4aae1cafde9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3089cf6d3caa1eb344aac05c875f4aeaf891552d,c42db35518bb0eae42ec955520eee0aa94a4a6fe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3089cf6d3caa1eb344aac05c875f4aeaf891552d,b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T22:15:08.363849+00:00", "updated": "2026-10-01T06:45:02.274579+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}