CVE-2025-39854 Overview
CVE-2025-39854 is a NULL pointer dereference and potential use-after-free vulnerability in the Linux kernel's Intel Ethernet ice driver. The flaw resides in the ice_ll_ts_intr() function, which handles low latency Tx timestamp interrupts from E810 network adapter firmware. The function accesses the tx->in_use bitmap of the ice_ptp_tx tracking structure without first verifying that the tracker has been initialized. A local attacker triggering interrupt paths during driver initialization or reset flows can cause NULL access or use-after-free conditions, leading to kernel memory corruption or denial of service. The issue affects Linux kernel 6.17 release candidates rc1 through rc4.
Critical Impact
Local attackers with low privileges can trigger kernel NULL pointer dereference or use-after-free in the ice driver, resulting in denial of service or potential privilege escalation on systems using Intel E810 network adapters.
Affected Products
- Linux kernel 6.17-rc1
- Linux kernel 6.17-rc2, 6.17-rc3, 6.17-rc4
- Systems using the Intel E810 Ethernet controller with the ice driver
Discovery Timeline
- 2025-09-19 - CVE-2025-39854 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-39854
Vulnerability Analysis
The vulnerability is a use-after-free / NULL pointer dereference classified under [CWE-416] in the Linux kernel's Intel ice network driver. Recent E810 firmware versions expose an additional interrupt to deliver low latency Tx timestamps through a specialized firmware interface. This allows software to wait for an interrupt rather than polling registers. The interrupt handler shares the ice_ptp_tx tracking structure with the standard Tx timestamp path, including its ready bitmap used to track completed timestamps.
The ice_ll_ts_intr() function accesses tx->in_use and related fields without checking whether the tracker is initialized. During driver bring-up, teardown, or reset flows, the tracker may not yet be established or may be in the process of being freed. Concurrent interrupt delivery in these windows results in dereferencing invalid pointers within kernel context.
Root Cause
The root cause is a missing initialization check in the interrupt service routine. The reset flow clears the init field under lock before tearing down the tracker, but ice_ll_ts_intr() does not honor that field before accessing tracker state. This mirrors a class of bugs previously fixed in ice_ptp_ts_irq(). The fix ensures that in_use and other tracker fields are only inspected when the tracker is marked as initialized.
Attack Vector
Exploitation requires local access with low privileges on a system running an affected kernel with an Intel E810 adapter using low latency Tx timestamping firmware. An attacker can influence driver reset or reinitialization paths, for example by triggering link state changes or PTP configuration transitions, to race the interrupt handler against tracker teardown. Successful exploitation causes kernel panic (denial of service) or, depending on the freed memory contents, may enable memory corruption primitives.
No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-39854
Indicators of Compromise
- Kernel oops or panic messages referencing ice_ll_ts_intr or ice_ptp_tx in dmesg or /var/log/kern.log
- Unexpected network interface resets on hosts using Intel E810 adapters
- Repeated PTP or timestamping subsystem errors in kernel ring buffer logs
Detection Strategies
- Inventory Linux hosts running kernel version 6.17-rc1 through 6.17-rc4 with the ice driver loaded, using uname -r and lsmod | grep ice
- Monitor kernel crash telemetry and core dumps for stack traces originating in ice_ll_ts_intr or adjacent PTP handlers
- Correlate kernel panics with PTP configuration changes or interface reset events on E810-equipped systems
Monitoring Recommendations
- Forward kernel logs (journalctl -k) to a centralized logging platform and alert on ice driver oops or WARN traces
- Track kernel version drift across the fleet to identify hosts running unpatched release candidates
- Baseline PTP interrupt rates on E810 adapters and alert on anomalies coinciding with reset events
How to Mitigate CVE-2025-39854
Immediate Actions Required
- Identify hosts running Linux kernel 6.17-rc1 through 6.17-rc4 with Intel E810 network adapters and prioritize patching
- Apply the upstream kernel fix commits referenced in the vendor advisories or upgrade to a stable kernel release that includes the fix
- Restrict local access on affected hosts until patches are deployed, since exploitation requires local privileges
Patch Information
The issue is resolved by three upstream commits that add an initialization check before accessing tx->in_use in ice_ll_ts_intr(). Apply the fixes from the following commits: Linux Kernel Patch 2cde98a02da9, Linux Kernel Patch 923c267bdbb6, and Linux Kernel Patch f6486338fde3. Distributions shipping the 6.17 kernel should backport these commits, and users on release-candidate kernels should move to a fixed stable release.
Workarounds
- Downgrade to a stable Linux kernel release prior to 6.17-rc1 that does not include the vulnerable low latency Tx timestamp interrupt path
- Disable PTP low latency Tx timestamping on Intel E810 adapters where operationally acceptable to avoid triggering the affected interrupt handler
- Unload the ice driver on hosts that do not require Intel E810 networking, using modprobe -r ice
# Verify kernel version and ice driver status on affected hosts
uname -r
lsmod | grep ice
dmesg | grep -iE 'ice_ll_ts_intr|ice_ptp'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
