CVE-2025-39854

What it actually does

NULL dereference or use-after-free when ice_ll_ts_intr accesses the tx timestamp tracker in_use bitmap without verifying the tracker is initialized, similar to prior ice_ptp_ts_irq issues.

Why it matters to the business

System crashes, potential local privilege escalation, or container escape on affected Linux kernels with Intel E810 hardware; low EPSS but noted in container-optimized OS exploit chains and by groups targeting VM environments.

How an attack unfolds

An attacker with local access on a system using recent E810 firmware triggers the low-latency Tx timestamp interrupt path; ice_ll_ts_intr runs before the ice_ptp_tx tracker init flag is set, dereferencing a NULL or freed structure. Related container-privilege-escalation chains involving VMSCAPE and similar Linux kernel issues have been observed.

How to fix it

Update to a fixed kernel containing commit 2cde98a02da958357fe240a6ba269b69d913b6ba; for listed Debian encfs packages apply 1.8.1-1 or later where applicable.

How to confirm the fix worked

Confirm kernel version includes the referenced commit or later; inspect ice_ll_ts_intr for the added init-field check before accessing the in_use bitmap.

Typical attack path

1. Obtain local code execution or container access on vulnerable kernel
2. Trigger low-latency Tx timestamp completion interrupt
3. ice_ll_ts_intr executes without init check on ice_ptp_tx tracker
4. NULL dereference or use-after-free occurs leading to crash or memory corruption

How to detect it

Search kernel logs for oops/panic messages referencing ice_ll_ts_intr or ice_ptp_tx; correlate with container runtime events on systems running affected kernels.

What your security team should do

• Prioritize kernel updates on systems with Intel E810 hardware, especially container hosts
• Review and apply the exact fixed commit or package versions listed
• Monitor for related container-escape activity given observed threat-actor interest