CVE-2025-27723: Intel Ethernet 800 Use-After-Free Flaw

CVE-2025-27723 Overview

CVE-2025-27723 is a use-after-free vulnerability [CWE-416] in the Linux kernel driver for the Intel Ethernet 800 series network adapters. The flaw exists in versions prior to 2.3.14 and resides within Ring 0 kernel context. An authenticated local attacker with low privileges can trigger the condition to cause a denial of service. Successful exploitation does not impact confidentiality or integrity, but produces high availability impact on the affected system. The vulnerability requires local access and no user interaction, and exploitation complexity is low when the necessary attack requirements are present.

Critical Impact
A local authenticated user can trigger a kernel-level use-after-free in the Intel Ethernet 800 series driver, causing denial of service on systems running affected Linux driver versions.

Affected Products

Intel Ethernet 800 series Linux kernel driver versions before 2.3.14
Linux systems using the affected ice driver for Intel Ethernet 800 series adapters
Server and workstation deployments relying on Intel E810-based network interface cards

Discovery Timeline

2026-05-12 - CVE-2025-27723 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2025-27723

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] within the Linux kernel driver supporting Intel Ethernet 800 series adapters. The driver executes in Ring 0, meaning the freed memory access occurs within kernel address space. When the driver dereferences a pointer to memory that has already been released, the kernel can enter an inconsistent state and crash. The result is a denial of service affecting system availability without leaking data or modifying state.

The Common Weakness Enumeration entry [CWE-416] describes scenarios where a program continues to use a pointer after the referenced memory has been freed. In kernel drivers, this class of bug commonly results from race conditions between teardown paths and in-flight operations, or from missing reference counting on shared driver objects.

Root Cause

The root cause is improper lifetime management of a kernel object within the Intel Ethernet 800 series driver code path. The driver frees a structure while another execution context retains and later dereferences a stale pointer to it. Because the access occurs in kernel mode, the resulting fault destabilizes the host rather than a user-space process.

Attack Vector

Exploitation requires local access and an authenticated user account with low privileges. The attacker interacts with the driver through legitimate kernel interfaces exposed to user space, such as ioctls, netlink, or socket operations against the network interface. No user interaction beyond the attacker's own actions is required. The attack is limited to denial of service; the CVSS metrics indicate no confidentiality or integrity impact.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is low, reflecting limited likelihood of opportunistic exploitation in the near term.

Technical details are described in the Intel Security Advisory SA-01426.

Detection Methods for CVE-2025-27723

Indicators of Compromise

Unexpected kernel oops or panic messages in dmesg or /var/log/kern.log referencing the ice driver or Intel Ethernet 800 series functions
Sudden loss of network connectivity on E810-based interfaces coinciding with kernel fault traces
KASAN reports flagging use-after-free in Intel Ethernet driver code paths on instrumented kernels

Detection Strategies

Inventory Linux hosts and identify systems running Intel Ethernet 800 series adapters with driver versions earlier than 2.3.14
Monitor kernel ring buffer output for crash signatures referencing the ice driver module
Correlate authenticated local sessions with kernel fault events to identify potential triggering activity

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on ice driver fault patterns
Track driver and kernel module versions across the fleet to confirm patch coverage
Audit local user activity on systems exposing the affected driver, particularly accounts with shell access to production hosts

How to Mitigate CVE-2025-27723

Immediate Actions Required

Upgrade the Intel Ethernet 800 series Linux driver (ice) to version 2.3.14 or later on all affected hosts
Apply distribution kernel updates that incorporate the fixed driver where the driver ships in-tree
Restrict local shell access on systems running vulnerable driver versions until patching is complete

Patch Information

Intel addressed the issue in driver version 2.3.14. Refer to the Intel Security Advisory SA-01426 for the official remediation guidance and download locations. Operators running distribution-packaged kernels should track their vendor's advisory feed for backported fixes.

Workarounds

Limit local interactive access to trusted administrators on hosts using affected Intel Ethernet 800 series adapters
Where feasible, unload the ice driver and use an alternative network interface until the patched driver is installed
Enforce least privilege so that unprivileged users cannot run code on systems hosting the vulnerable driver

bash

# Verify the loaded ice driver version on a Linux host
modinfo ice | grep -E '^version:'

# Example expected output after patching
# version:        2.3.14