Linux kernel ice: unserialized XDP setup races a PF reset and NULL-derefs on the TX ring

Impact

The ice driver for Intel E810-class datacenter NICs did not serialize XDP program/AF_XDP setup against an asynchronous PF reset, which a TX timeout handler can trigger on its own. With unlucky timing, ice_vsi_rebuild() tears down XDP rings while the reset path is already freeing them, and the kernel oopses in ice_clean_tx_ring() as shown in the reported trace. On a GPU node this is an availability problem on the data path: the host panics or the NIC service task dies while jobs are resident, and a node that cannot be drained cheaply is lost mid-run. There is no confidentiality or integrity component - the CVSS vector is availability-only.

Who can reach it

Local, requires privileges: a user able to attach or detach an XDP program or an AF_XDP socket on an ice interface (CAP_NET_ADMIN), racing a reset that can also be triggered by a TX timeout with no attacker involvement at all. Not reachable from a tenant pod unless it holds net admin on the host netns.

What to do

Take the stable kernel that adds the XDP configuration mutex in ice (commits linked in the record); the fix is in the ice driver, so a kernel update plus node reboot is required, or reload the ice module with the interface out of service. Until then, avoid reconfiguring XDP/AF_XDP on ice interfaces on a node under load. The record names no single fixed release - pick the stable branch your fleet tracks from the linked commits.

References

Related entries

• Linux kernel (drivers/gpu/drm/xe): Same per-client accounting path, different failure - if the fdinfo read drops theCVE-2024-46867 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel BPF verifier: sign-extended packet-pointer loads produce an invalid skb->data addressCVE-2024-47702 · Linux kernel BPF verifier (sign-extended loads of __sk_buff data/data_end/data_meta)Medium
• Linux kernel (drivers/gpu/drm/xe): User VM_BIND work is scheduled onto engines that can themselves take page faultsCVE-2024-47729 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel BPF: freplace program in a tail-call chain resets tail_call_cnt and panics the kernelCVE-2024-47794 · Linux kernel BPF (tail calls combined with freplace extension programs)Medium
• Linux kernel x86/mm: identity maps built from 1 GB pages cover unrequested reserved memoryCVE-2024-50017 · Linux kernel x86 identity mapping (ident_pud_init GB-page mapping)Medium
• Linux kernel (net/xfrm): Dumping SAs over xfrm netlink copies algorithm structures that were never fully initializedCVE-2024-50110 · Linux kernel (net/xfrm)Medium