Medium 5.5Published Jun 24, 2026

CVE-2026-53007ice: fix potential NULL pointer deref in error path of ice_set_ringparam()

Updated under an hour ago (2026-10-19 07:00 UTC)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ice: fix potential NULL pointer deref in error path of ice_set_ringparam() ice_set_ringparam nullifies tstamp_ring of temporary tx_rings, without clearing ICE_TX_RING_FLAGS_TXTIME bit. When ICE_TX_RING_FLAGS_TXTIME is set and the subsequent ice_setup_tx_ring() call fails, a NULL pointer dereference could happen in the unwinding sequence: ice_clean_tx_ring() -> ice_is_txtime_cfg() == true (ICE_TX_RING_FLAGS_TXTIME is set) -> ice_free_tx_tstamp_ring() -> ice_free_tstamp_ring() -> tstamp_ring->desc (NULL deref) Clear ICE_TX_RING_FLAGS_TXTIME bit to avoid the potential issue. Note that this potential issue is found by manual code review. Compile test only since unfortunately I don't have E830 devices.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 before c789649d4334a3767210071311d58bc8e74bdec1; from ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 before c54e3c270384829336b2526033d44ce1aa6dc67c; from ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 before fa28351f970fa5138c7c5dedfe5dea480a0ee065	CNA record
linux linux_kernel linux:linux_kernel	from 6.18 before 7.0.10	NVD

References

https://git.kernel.org/stable/c/c789649d4334a3767210071311d58bc8e74bdec1
https://git.kernel.org/stable/c/c54e3c270384829336b2526033d44ce1aa6dc67cpatch
https://git.kernel.org/stable/c/fa28351f970fa5138c7c5dedfe5dea480a0ee065patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.