Linux kernel ice: NULL dereference in the E810 PTP Tx timestamp IRQ racing driver reset

Impact

ice_ptp_ts_irq() reads the Tx timestamp tracker's in_use bitmap without checking the tracker is initialized, so a timestamp interrupt arriving while the driver reset path is tearing the tracker down dereferences NULL inside _find_first_bit() - the record carries the actual panic trace through ice_misc_intr(). On GPU nodes with Intel E810 NICs and PTP timestamping on (common for synchronized training telemetry), a NIC reset under load can panic the host and take resident jobs with it. Same missing-initialization-check class as CVE-2025-39854, but in the standard timestamp IRQ handler rather than the low-latency one; the kernel fixed them as separate commits.

Who can reach it

No authenticated or tenant-facing path described. Requires an E810 NIC with PTP Tx timestamping active and a timestamp interrupt racing the ice driver reset flow.

What to do

Pick up the stable kernel fix (two backports linked) and reboot each affected node. There is no mitigation short of a new kernel other than not running PTP timestamping on E810 interfaces. The record names no fixed release number - compare the linked commits with your stable branch.

References

Related entries

• Linux kernel idxd: double free in idxd_setup_wqs() error path during DSA device probeCVE-2025-39870 · Linux kernel idxd driver (Intel Data Streaming Accelerator / DSA work-queue setup)High
• Linux kernel idxd: refcount underflow and use-after-free when unloading the Intel DSA driverCVE-2025-39871 · Linux kernel idxd driver (Intel DSA, device refcount on module removal)High
• Linux kernel DAMON sysfs: use-after-free reading kdamond state while a context is torn downCVE-2025-39877 · Linux kernel DAMON sysfs interface (state_show, /sys/kernel/mm/damon)High
• Linux kernel libceph: messenger reads and writes the v1 union member while msgr2 is in use, corrupting connection stateCVE-2025-39880 · Linux kernel libceph messenger (con->v1 union accessed while msgr2 is active)High
• Linux kernel FUSE: slab out-of-bounds write in fuse_dev_do_write when the retrieve length is truncatedCVE-2025-39888 · Linux kernel FUSE (fuse_dev_do_write, folio limit check)High
• Linux kernel i40e: wrong dev_id in free_irq() leaves IRQs un-freed on the MSI-X error pathCVE-2025-39911 · Linux kernel i40e driver (Intel X710/XL710 MSI-X IRQ request error path)High