Linux kernel ice: failed VF flow-director filter setup leaves stale entries and leaks FDIR context

CVSS 8.8CVE-2023-54040Kernel, userspace & hypervisorcurated

Impact

In the Intel E810 (ice) driver, a failure in ice_vc_fdir_set_irq_ctx left the inserted flow director entry in place, and a failure in ice_vc_fdir_write_fltr left the FDIR context for the interrupt handler uncleared - leaving the host driver in an inconsistent state and leaking memory. The actor on this path is a virtual function, so on a GPU node that passes SR-IOV VFs of a 100G NIC into tenant VMs or pods, the tenant's virtchnl requests drive host-side driver state. Repeated failures accumulate host kernel memory and inconsistent filter state, which NVD scores as a scope-changing local issue; the realistic operator outcome is host instability on a node whose NIC is shared across tenants. Nodes not using ice SR-IOV VFs are unaffected.

Who can reach it

Local - a tenant controlling a VF of an ice-driven NIC, sending flow-director configuration over virtchnl to the host PF driver. Requires control of the guest or pod holding the VF, not host privileges.

What to do

Update the host kernel to a stable release carrying the ice FDIR failure-path cleanup (commits in the record) and reboot each affected node; unloading and reloading the ice module would drop every VF and the NIC itself, so in practice this is a drain and reboot. No vendor mitigation is given short of not exposing ice VFs to untrusted guests.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-54040 https://git.kernel.org/stable/c/391d28c0e38c0e5b11a4240a2b4976cf63e87f45 https://git.kernel.org/stable/c/b4a01ace20f5c93c724abffc0a83ec84f514b98d https://git.kernel.org/stable/c/cbfed5f114b5310f221979fc8190f55c6abc3400

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.