Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Improper initialisation in the Linux

Impact

MULTI-TENANT ISOLATION: Improper initialisation in the Linux kernel-mode driver for Intel 800-series Ethernet, reachable by an authenticated user for privilege escalation. The 800 series (E810) is the NIC under most RoCE/RDMA AI fabrics, so a kernel-mode driver escalation here is host compromise reached from whoever can talk to the network stack - and on nodes exposing SR-IOV VFs or RDMA verbs to tenants, that includes tenants.

Who can reach it

Authenticated local user; on nodes that expose VFs or RDMA devices into containers, that extends to tenant workloads.

What to do

Fixed in the Intel out-of-tree ice driver (or the equivalent in-kernel version). Updating the driver requires unloading and reloading the module, which drops every link on that NIC - on a node whose RDMA fabric carries collective traffic, that is a job-killing event, so drain first. If you take it via a distro kernel update instead, it is a reboot. No firmware flash for the driver-side fixes.

References