CVE-2026-23445

What it actually does

Use-after-free in the igc driver when stale xsk_meta pointers remain during TX ring shutdown, causing the PTP timestamp interrupt handler to dereference freed memory and trigger a kernel page fault.

Why it matters to the business

Systems using Intel I225/I226 adapters with XDP applications may experience kernel crashes, potential privilege escalation, or denial of service, resulting in unplanned downtime for servers or network appliances.

How an attack unfolds

A local user starts an XDP application requesting TX timestamps on an igc interface, then shuts the application down while the link stays up; the interrupt handler subsequently accesses the freed metadata, leading to a crash or exploitable UAF condition.

How to fix it

Apply a kernel update containing the fix that clears stale xsk_meta data on TX shutdown in the igc driver; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the igc driver source performs explicit cleanup of xsk_meta pointers during ring teardown; reproduce the shutdown scenario and verify absence of page-fault splats in dmesg.

Typical attack path

1. Obtain local unprivileged access
2. Attach XDP program requesting TX timestamping to igc interface
3. Trigger TX ring shutdown while link remains active
4. Allow PTP interrupt to fire and dereference stale pointer

How to detect it

Search system logs (dmesg, journalctl) for page-fault BUG reports referencing igc_ptp_tx_tstamp_event or igc_tsync_interrupt during XDP application termination.

• igc_ptp_tx_tstamp_event+0xdf
• BUG: unable to handle page fault for address
• igc_tsync_interrupt
• xsk_meta pointers left behind

What your security team should do

• Expedite kernel patching on all hosts with igc NICs running XDP workloads
• Disable unprivileged XDP or PTP timestamping where feasible until patched
• Add kernel oops monitoring for igc_ptp_tx_tstamp_event to SIEM