{"id":"CVE-2026-53008","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix race condition in TX timestamp ring cleanup\n\nFix a race condition between ice_free_tx_tstamp_ring() and ice_tx_map()\nthat can cause a NULL pointer dereference.…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix race condition in TX timestamp ring cleanup\n\nFix a race condition between ice_free_tx_tstamp_ring() and ice_tx_map()\nthat can cause a NULL pointer dereference.…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-362"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.18, < 7.0.10"],"patched":["linux_kernel 7.0.10"],"published":"2026-06-24","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:35.717","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53008","references":[{"url":"https://git.kernel.org/stable/c/097409d20465723283632515df73038a4a853eda","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c72ec18c2a4111204c2e915f8e4f6d849ce9398","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e98cea6d5562f546482fab8ad571e95e3fff1800","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00109,"epssPercentile":0.01236,"ingestedAt":"2026-07-11T17:13:40.324Z","slug":"CVE-2026-53008","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nice: fix race condition in TX timestamp ring cleanup\n\nFix a race condition between ice_free_tx_tstamp_ring() and ice_tx_map()\nthat can cause a NULL pointer dereference.\n\nice_free_tx_tstamp_ring currently clears the ICE_TX_FLAGS_TXTIME flag\nafter NULLing the tstamp_ring. This could allow a concurrent ice_tx_map\ncall on another CPU to dereference the tstamp_ring, which could lead to\na NULL pointer dereference.\n\n  CPU A:ice_free_tx_tstamp_ring() | CPU B:ice_tx_map()\n  --------------------------------|---------------------------------\n  tx_ring->tstamp_ring = NULL     |\n                                  | ice_is_txtime_cfg() -> true\n                                  | tstamp_ring = tx_ring->tstamp_ring\n                                  | tstamp_ring->count  // NULL deref!\n  flags &= ~ICE_TX_FLAGS_TXTIME   |\n\nFix by:\n1. Reordering ice_free_tx_tstamp_ring() to clear the flag before\n   NULLing the pointer, with smp_wmb() to ensure proper ordering.\n2. Adding smp_rmb() in ice_tx_map() after the flag check to order the\n   flag read before the pointer read, using READ_ONCE() for the\n   pointer, and adding a NULL check as a safety net.\n3. Converting tx_ring->flags from u8 to DECLARE_BITMAP() and using\n   atomic bitops (set_bit(), clear_bit(), test_bit()) for all flag\n   operations throughout the driver:\n   - ICE_TX_RING_FLAGS_XDP\n   - ICE_TX_RING_FLAGS_VLAN_L2TAG1\n   - ICE_TX_RING_FLAGS_VLAN_L2TAG2\n   - ICE_TX_RING_FLAGS_TXTIME\n\n## Affected\n\n- `linux_kernel >= 6.18, < 7.0.10`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.10`","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222306,"id":"CVE-2026-53008","ts":1792065873559,"field":"cvss","old":null,"new":"4.7"},{"seq":222305,"id":"CVE-2026-53008","ts":1792065873559,"field":"severity","old":"none","new":"medium"}]}