CVE-2025-38127

What it actually does

Improper rollback in ice XDP callback on Tx scheduler failure leaves XDP queues mapped to q_vectors and XDP rings pointer non-NULL, allowing subsequent use-after-free or invalid pointer dereference in __ice_update_sample during napi poll that results in general protection fault.

Why it matters to the business

Systems using Intel E810/E822 network adapters with XDP enabled can experience kernel crashes and reboots under load or when XDP programs are attached, causing network outage and service disruption; the bug is present in multiple stable kernel trees until the referenced commit.

How an attack unfolds

An attacker with the ability to load an XDP program or trigger ring allocation failure causes the ice driver to enter an inconsistent state; later softirq processing dereferences the stale ring pointer, producing a crash that may be turned into memory corruption by an adversary controlling packet timing or XDP program behavior.

How to fix it

Upgrade the Linux kernel to a version containing commit 1d3c5d0dec6797eca3a861dab0816fa9505d9c3e or later; rebuild and reboot with the patched ice driver; disable XDP on affected interfaces until the update is applied if immediate reboot is not feasible.

How to confirm the fix worked

Confirm the running kernel contains commit 1d3c5d0dec6797eca3a861dab0816fa9505d9c3e via 'git log --oneline' or package version check; attempt to attach an XDP program that previously triggered the failure path and verify no Oops or GPF occurs in ice_napi_poll or __ice_update_sample.

Typical attack path

1. Load or attach XDP program that exercises Tx queue addition path
2. Force Tx scheduler configuration failure (error -5)
3. Trigger incomplete rollback leaving stale q_vector mappings
4. Induce napi poll that calls __ice_update_sample on freed or invalid ring
5. Observe general protection fault and potential escalation via corrupted kernel state

How to detect it

Search kernel logs for the strings 'Failed VSI LAN queue config for XDP' followed by 'Oops: general protection fault' and RIP containing __ice_update_sample or ice_napi_poll; inspect dmesg and journalctl for call traces involving XDP ring operations on ice devices.

What your security team should do

• Prioritize patching kernel packages on all hosts with ice network devices within the next maintenance window
• Monitor for any new EPSS increase or public exploit code targeting this XDP error path
• Temporarily restrict unprivileged XDP loading via sysctl or seccomp until kernels are updated
• Include the fixed commit hash in SBOM and vulnerability scanning rules for downstream distributions