CVE-2024-26855

What it actually does

NULL pointer dereference in ice_bridge_setlink() when nlmsg_find_attr() returns NULL, causing subsequent dereference of br_spec during nla_for_each_nested() iteration and resulting in kernel panic.

Why it matters to the business

Local denial-of-service on systems using Intel ice Ethernet drivers, leading to unplanned reboots, loss of network connectivity, and potential disruption of workloads until the system is restarted or patched.

How an attack unfolds

An attacker with local access crafts a netlink message that causes nlmsg_find_attr() to return NULL for the bridge attributes; the function then proceeds to dereference the NULL br_spec pointer inside the nested attribute loop, triggering a kernel crash.

How to fix it

Update the Linux kernel to a version containing commit d9fefc51133107e59d192d773be86c1150cfeebb or later; rebuild and reboot into the patched kernel; apply vendor backports if using a distribution kernel.

How to confirm the fix worked

Confirm the running kernel contains commit d9fefc51133107e59d192d773be86c1150cfeebb via git log or kernel version string; test that bridge setlink operations no longer cause crashes under the previously triggering netlink inputs.

Typical attack path

1. Obtain local shell access on a vulnerable Linux system using the ice driver
2. Craft and send a malformed netlink RTM_SETLINK message targeting bridge configuration
3. Trigger ice_bridge_setlink() path where nlmsg_find_attr() returns NULL
4. Cause kernel panic via NULL dereference during nla_for_each_nested()

How to detect it

Review kernel logs for oops or panic messages mentioning ice_bridge_setlink or NULL pointer dereference in the ice module; correlate with recent netlink bridge configuration activity from local processes.

What your security team should do

• Prioritize kernel updates on systems exposing the ice driver to untrusted local users
• Monitor for kernel oops/panic logs referencing ice_bridge_setlink
• Restrict local unprivileged access until patches are deployed