Cloudanix VulnDB

CVE-2026-98965

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel networking bug on certain arm64 servers with Intel network cards can cause the entire system to crash when handling heavy network traffic.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in the ICE driver where writel_relaxed() allows the NIC to process Tx descriptors before the dql num_queued update becomes globally visible on arm64, triggering BUG_ON(count > num_queued - dql->num_completed) in dql_completed and causing a kernel panic.

Why it matters to the business

Sustained high network traffic on affected Intel E810 hardware running on arm64 systems produces repeatable kernel crashes, resulting in unplanned downtime, service interruption, and potential data loss for workloads relying on those NICs.

How an attack unfolds

An attacker or workload generates continuous high-volume network traffic directed at an arm64 system using the vulnerable ICE driver; the relaxed MMIO write ordering lets the NIC finish transmission before the accounting update is visible, hitting the invalid state check and crashing the kernel.

How to fix it

Update to a kernel containing the fix that replaces writel_relaxed() with writel() for Tx doorbell writes in the ICE driver; apply the change from the referenced commit that restored ordered MMIO behavior.

How to confirm the fix worked

Confirm the driver source no longer uses writel_relaxed() for Tx queue tail updates, reproduce sustained network load on arm64 hardware, and verify absence of the dql_completed BUG_ON crash.

Typical attack path

  1. Send sustained high-rate network traffic to the target arm64 host with ICE/E810 NIC
  2. Driver performs Tx doorbell via writel_relaxed() before dql->num_queued update is visible
  3. NIC processes descriptors and completes work before accounting update is observed
  4. dql_completed detects count > num_queued and hits BUG_ON, panicking the kernel

How to detect it

Search kernel logs and crash dumps for the strings 'kernel BUG at lib/dynamic_queue_limits.c', 'dql_completed', 'ice_clean_tx_irq', and 'BUG_ON(count > num_queued' on arm64 hosts with ICE driver; correlate with high Tx load periods.

  • kernel BUG at lib/dynamic_queue_limits.c:99
  • dql_completed+0x268/0x2a0
  • ice_clean_tx_irq
  • BUG_ON(count > num_queued - dql->num_completed)

What your security team should do

  • Prioritize kernel upgrade for all arm64 systems using Intel E810/E830 NICs within the next maintenance window
  • Monitor kernel logs for dql_completed BUG_ON and ice_clean_tx_irq traces on affected hosts
  • Temporarily reduce network load or migrate workloads off vulnerable arm64+ICE configurations until patched

The record

In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql->num_queued, is updated by the ICE driver when it invokes __netdev_tx_sent_queue(). Subsequently the driver updates the hardware queue tail allowing the NIC to begin processing the work queue. The queue accounting update should be ordered before the NIC begins transmitting descriptors. The transmit path currently updates the hardware doorbell using writel_relaxed(), which (on arm64) does not provide the same ordering guarantees between writes to normal memory and writes to MMIO registers that writel() does. This introduces a potential race where the NIC begins transmitting descriptors before the dql->num_queued update is globally visible. If the NIC finishes before the update is observed by dql_completed(), it detects an invalid state where more bytes have been completed than have been queued. When this happens the following BUG_ON is triggered. BUG_ON(count > num_queued - dql->num_completed); This has been observed and manifests as the following crash (note that the trace has been trimmed) in an environment with sustained network load that uses an Intel Corporation Ethernet Controller E810-XXV for SFP (rev 02) on an arm64 machine. Replacing writel_relaxed() with writel() in a test kernel eliminated the crash in the user's workload, which previously reproduced the issue reliably. kernel BUG at lib/dynamic_queue_limits.c:99 Internal error: Oops - BUG: 00000000f2000800 [#1] SMP pc : dql_completed+0x268/0x2a0 lr : ice_clean_tx_irq+0x1d4/0x620 [ice] Call trace: dql_completed+0x268/0x2a0 (P) ice_napi_poll+0x94/0x520 [ice] __napi_poll+0x48/0x3f0 net_rx_action+0x194/0x420 This restores the behaviour prior to commit ccde82e90946 ("ice: add E830 Earliest TxTime First Offload support"), which changed the notification mechanism from writel() to writel_relaxed().

Affected packages

Ecosystem Package Introduced Fixed