Linux kernel ice: NULL dereference in the E810 low-latency PTP timestamp interrupt during reset

Impact

ice_ll_ts_intr() touches the Tx timestamp tracker without checking that it is initialized, so a low-latency PTP timestamp interrupt racing the driver reset path gives a NULL dereference or use-after-free in interrupt context. Intel E810 is a common 100G NIC on GPU nodes, and PTP hardware timestamping is routinely enabled for training-cluster time sync, so the racing condition is a normal operational event (a NIC reset under load), not an attacker action. The consequence is a node panic - on a GPU host that means losing whatever job was resident and an unplanned drain. This is the companion of CVE-2025-39855, which fixes the same missing check in the standard timestamp IRQ handler; both were fixed separately because they are different handlers.

Who can reach it

Not a tenant-reachable path. Triggered by a race between an E810 low-latency Tx timestamp interrupt and the driver reset flow; requires the ice driver with PTP low-latency firmware support in use.

What to do

Update to a stable kernel carrying the fix (three backports linked in the record) and reboot the affected nodes; a driver-level fix on the interrupt path cannot be hot-applied. No fixed version string is given in the record - match the linked commits against the stable branch you run. Nodes without E810 NICs or with PTP disabled are not exposed.

References

Related entries

• Linux kernel ice: NULL dereference in the E810 PTP Tx timestamp IRQ racing driver resetCVE-2025-39855 · Linux kernel ice driver (Intel E810 PTP Tx timestamp IRQ, ice_ptp_ts_irq)High
• Linux kernel idxd: double free in idxd_setup_wqs() error path during DSA device probeCVE-2025-39870 · Linux kernel idxd driver (Intel Data Streaming Accelerator / DSA work-queue setup)High
• Linux kernel idxd: refcount underflow and use-after-free when unloading the Intel DSA driverCVE-2025-39871 · Linux kernel idxd driver (Intel DSA, device refcount on module removal)High
• Linux kernel DAMON sysfs: use-after-free reading kdamond state while a context is torn downCVE-2025-39877 · Linux kernel DAMON sysfs interface (state_show, /sys/kernel/mm/damon)High
• Linux kernel libceph: messenger reads and writes the v1 union member while msgr2 is in use, corrupting connection stateCVE-2025-39880 · Linux kernel libceph messenger (con->v1 union accessed while msgr2 is active)High
• Linux kernel FUSE: slab out-of-bounds write in fuse_dev_do_write when the retrieve length is truncatedCVE-2025-39888 · Linux kernel FUSE (fuse_dev_do_write, folio limit check)High