Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Improper input validation

Impact

MULTI-TENANT ISOLATION: Improper input validation in the 800-series Linux kernel driver allowing an authenticated user to escalate. Highest-scored of the 2025 ice driver batch.

Who can reach it

Authenticated local user; extends to tenants on VF/RDMA-exposing nodes.

What to do

Fixed in the Intel out-of-tree ice driver (or in-kernel equivalent). Updating the driver requires unloading and reloading the module, which drops every link on that NIC - on a node whose RDMA fabric carries collective traffic, that is a job-killing event, so drain first. If you take it via a distro kernel update instead, it is a reboot. No firmware flash for the driver-side fixes. Target ice 1.17.2 or later.

References