---
id: CVE-2025-38526
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ice: add NULL check in eswitch lag check

  The function ice_lag_is_switchdev_running() is being called from outside of
  the LAG event handler code
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ice: add NULL check in eswitch lag check

  The function ice_lag_is_switchdev_running() is being called from outside of
  the LAG event handler code.  This results in the l…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.6.1, < 6.6.100'
  - 'linux_kernel >= 6.7, < 6.12.40'
  - 'linux_kernel >= 6.13, < 6.15.8'
  - linux_kernel = 6.6
  - linux_kernel = 6.16
patched:
  - linux_kernel 6.15.8
published: '2025-08-16'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:44.427'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38526'
references:
  - url: 'https://git.kernel.org/stable/c/245917d3c5ed7c6ae720302b64eac5c6f0c85177'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/27591d926191e42b2332e4bad3bcd3a49def393b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3ce58b01ada408b372f15b7c992ed0519840e3cf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5a5d64f0eec82076b2c09fee2195d640cfbe3379'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00382
epssPercentile: 0.32112
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:51:23.742828Z'
ingestedAt: '2026-10-15T22:48:25.511Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ice: add NULL check in eswitch lag check

The function ice_lag_is_switchdev_running() is being called from outside of
the LAG event handler code.  This results in the lag->upper_netdev being
NULL sometimes.  To avoid a NULL-pointer dereference, there needs to be a
check before it is dereferenced.

## Affected

- `linux_kernel >= 6.6.1, < 6.6.100`
- `linux_kernel >= 6.7, < 6.12.40`
- `linux_kernel >= 6.13, < 6.15.8`
- `linux_kernel = 6.6`
- `linux_kernel = 6.16`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.15.8`