{"id":"CVE-2026-53007","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix potential NULL pointer deref in error path of ice_set_ringparam()\n\nice_set_ringparam nullifies tstamp_ring of temporary tx_rings, without\nclearing ICE_TX_RING_…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix potential NULL pointer deref in error path of ice_set_ringparam()\n\nice_set_ringparam nullifies tstamp_ring of temporary tx_rings, without\nclearing ICE_TX_RING_…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.18, < 7.0.10"],"patched":["linux_kernel 7.0.10"],"published":"2026-06-24","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:35.593","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53007","references":[{"url":"https://git.kernel.org/stable/c/c54e3c270384829336b2526033d44ce1aa6dc67c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c789649d4334a3767210071311d58bc8e74bdec1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fa28351f970fa5138c7c5dedfe5dea480a0ee065","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.0016,"epssPercentile":0.05127,"ingestedAt":"2026-07-11T17:13:40.308Z","slug":"CVE-2026-53007","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nice: fix potential NULL pointer deref in error path of ice_set_ringparam()\n\nice_set_ringparam nullifies tstamp_ring of temporary tx_rings, without\nclearing ICE_TX_RING_FLAGS_TXTIME bit.\nWhen ICE_TX_RING_FLAGS_TXTIME is set and the subsequent\nice_setup_tx_ring() call fails, a NULL pointer dereference could happen\nin the unwinding sequence:\n\nice_clean_tx_ring()\n-> ice_is_txtime_cfg() == true (ICE_TX_RING_FLAGS_TXTIME is set)\n-> ice_free_tx_tstamp_ring()\n  -> ice_free_tstamp_ring()\n    -> tstamp_ring->desc (NULL deref)\n\nClear ICE_TX_RING_FLAGS_TXTIME bit to avoid the potential issue.\n\nNote that this potential issue is found by manual code review.\nCompile test only since unfortunately I don't have E830 devices.\n\n## Affected\n\n- `linux_kernel >= 6.18, < 7.0.10`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.10`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222304,"id":"CVE-2026-53007","ts":1792065873206,"field":"cvss","old":null,"new":"5.5"},{"seq":222303,"id":"CVE-2026-53007","ts":1792065873206,"field":"severity","old":"none","new":"medium"}]}