Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Kernel-mode driver flaw in the Intel

Impact

MULTI-TENANT ISOLATION: Kernel-mode driver flaw in the Intel 800-series Ethernet Linux driver (improper input validation) giving an authenticated user privilege escalation. Same family and same fix train as the other 2024 ice driver issues; the reason to care is that E810 is the fabric NIC on most GPU nodes and its driver runs in the kernel on the host.

Who can reach it

Authenticated local user, including tenant workloads on nodes that map VFs or RDMA devices into containers.

What to do

Fixed in the Intel out-of-tree ice driver (or the equivalent in-kernel version). Updating the driver requires unloading and reloading the module, which drops every link on that NIC - on a node whose RDMA fabric carries collective traffic, that is a job-killing event, so drain first. If you take it via a distro kernel update instead, it is a reboot. No firmware flash for the driver-side fixes.

References