Vulnerability-Lookup

GHSA-272R-G6C6-94W3

Vulnerability from github – Published: 2026-10-23 15:31 – Updated: 2026-10-24 15:32

Details

In the Linux kernel, the following vulnerability has been resolved:

ice: Restore Ordered MMIO Writes for Tx Doorbells

The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql->num_queued, is updated by the ICE driver when it invokes __netdev_tx_sent_queue(). Subsequently the driver updates the hardware queue tail allowing the NIC to begin processing the work queue. The queue accounting update should be ordered before the NIC begins transmitting descriptors.

The transmit path currently updates the hardware doorbell using writel_relaxed(), which (on arm64) does not provide the same ordering guarantees between writes to normal memory and writes to MMIO registers that writel() does. This introduces a potential race where the NIC begins transmitting descriptors before the dql->num_queued update is globally visible. If the NIC finishes before the update is observed by dql_completed(), it detects an invalid state where more bytes have been completed than have been queued. When this happens the following BUG_ON is triggered.

BUG_ON(count > num_queued - dql->num_completed);

This has been observed and manifests as the following crash (note that the trace has been trimmed) in an environment with sustained network load that uses an Intel Corporation Ethernet Controller E810-XXV for SFP (rev 02) on an arm64 machine. Replacing writel_relaxed() with writel() in a test kernel eliminated the crash in the user's workload, which previously reproduced the issue reliably.

kernel BUG at lib/dynamic_queue_limits.c:99

Internal error: Oops - BUG: 00000000f2000800 [#1] SMP pc : dql_completed+0x268/0x2a0 lr : ice_clean_tx_irq+0x1d4/0x620 [ice] Call trace: dql_completed+0x268/0x2a0 (P) ice_napi_poll+0x94/0x520 [ice] __napi_poll+0x48/0x3f0 net_rx_action+0x194/0x420

This restores the behaviour prior to commit ccde82e90946 ("ice: add E830 Earliest TxTime First Offload support"), which changed the notification mechanism from writel() to writel_relaxed().

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98965"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T13:17:17Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Restore Ordered MMIO Writes for Tx Doorbells\n\nThe DQL accounting state which tracks the number of bytes queued for the\nNIC to transmit, namely dql-\u003enum_queued, is updated by the ICE driver\nwhen it invokes __netdev_tx_sent_queue(). Subsequently the driver\nupdates the hardware queue tail allowing the NIC to begin processing the\nwork queue. The queue accounting update should be ordered before the NIC\nbegins transmitting descriptors.\n\nThe transmit path currently updates the hardware doorbell using\nwritel_relaxed(), which (on arm64) does not provide the same ordering\nguarantees between writes to normal memory and writes to MMIO registers\nthat writel() does. This introduces a potential race where the NIC\nbegins transmitting descriptors before the dql-\u003enum_queued update is\nglobally visible. If the NIC finishes before the update is observed by\ndql_completed(), it detects an invalid state where more bytes have been\ncompleted than have been queued. When this happens the following BUG_ON\nis triggered.\n\n  BUG_ON(count \u003e num_queued - dql-\u003enum_completed);\n\nThis has been observed and manifests as the following crash (note that\nthe trace has been trimmed) in an environment with sustained network\nload that uses an Intel Corporation Ethernet Controller E810-XXV for SFP\n(rev 02) on an arm64 machine. Replacing writel_relaxed() with writel()\nin a test kernel eliminated the crash in the user\u0027s workload, which\npreviously reproduced the issue reliably.\n\n  kernel BUG at lib/dynamic_queue_limits.c:99\n\nInternal error: Oops - BUG: 00000000f2000800 [#1] SMP\npc : dql_completed+0x268/0x2a0\nlr : ice_clean_tx_irq+0x1d4/0x620 [ice]\nCall trace:\ndql_completed+0x268/0x2a0 (P)\nice_napi_poll+0x94/0x520 [ice]\n__napi_poll+0x48/0x3f0\nnet_rx_action+0x194/0x420\n\nThis restores the behaviour prior to commit ccde82e90946 (\"ice: add E830\nEarliest TxTime First Offload support\"), which changed the notification\nmechanism from writel() to writel_relaxed().",
  "id": "GHSA-272r-g6c6-94w3",
  "modified": "2026-10-24T15:32:48Z",
  "published": "2026-10-23T15:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98965"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7a579dec8423bba7bec96fcfcb2e30838b0858ee"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b7725acf9c574debb97ae1613569ac9e148438be"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f94ab1fffd009250d72c6dc1662cb84467ac5365"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-98965 (GCVE-0-2026-98965)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:19 – Updated: 2026-10-24 14:09

Title

ice: Restore Ordered MMIO Writes for Tx Doorbells

Summary

In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql->num_queued, is updated by the ICE driver when it invokes __netdev_tx_sent_queue(). Subsequently the driver updates the hardware queue tail allowing the NIC to begin processing the work queue. The queue accounting update should be ordered before the NIC begins transmitting descriptors. The transmit path currently updates the hardware doorbell using writel_relaxed(), which (on arm64) does not provide the same ordering guarantees between writes to normal memory and writes to MMIO registers that writel() does. This introduces a potential race where the NIC begins transmitting descriptors before the dql->num_queued update is globally visible. If the NIC finishes before the update is observed by dql_completed(), it detects an invalid state where more bytes have been completed than have been queued. When this happens the following BUG_ON is triggered. BUG_ON(count > num_queued - dql->num_completed); This has been observed and manifests as the following crash (note that the trace has been trimmed) in an environment with sustained network load that uses an Intel Corporation Ethernet Controller E810-XXV for SFP (rev 02) on an arm64 machine. Replacing writel_relaxed() with writel() in a test kernel eliminated the crash in the user's workload, which previously reproduced the issue reliably. kernel BUG at lib/dynamic_queue_limits.c:99 Internal error: Oops - BUG: 00000000f2000800 [#1] SMP pc : dql_completed+0x268/0x2a0 lr : ice_clean_tx_irq+0x1d4/0x620 [ice] Call trace: dql_completed+0x268/0x2a0 (P) ice_napi_poll+0x94/0x520 [ice] __napi_poll+0x48/0x3f0 net_rx_action+0x194/0x420 This restores the behaviour prior to commit ccde82e90946 ("ice: add E830 Earliest TxTime First Offload support"), which changed the notification mechanism from writel() to writel_relaxed().

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7067 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/b7725acf9c574debb…
https://git.kernel.org/stable/c/f94ab1fffd009250d…
https://git.kernel.org/stable/c/7a579dec8423bba7b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 , < b7725acf9c574debb97ae1613569ac9e148438be (git) Affected: ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 , < f94ab1fffd009250d72c6dc1662cb84467ac5365 (git) Affected: ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 , < 7a579dec8423bba7bec96fcfcb2e30838b0858ee (git)
Linux	Linux	Affected: 6.18 Unaffected: 0 , < 6.18 (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b7725acf9c574debb97ae1613569ac9e148438be",
              "status": "affected",
              "version": "ccde82e909467abdf098a8ee6f63e1ecf9a47ce5",
              "versionType": "git"
            },
            {
              "lessThan": "f94ab1fffd009250d72c6dc1662cb84467ac5365",
              "status": "affected",
              "version": "ccde82e909467abdf098a8ee6f63e1ecf9a47ce5",
              "versionType": "git"
            },
            {
              "lessThan": "7a579dec8423bba7bec96fcfcb2e30838b0858ee",
              "status": "affected",
              "version": "ccde82e909467abdf098a8ee6f63e1ecf9a47ce5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Restore Ordered MMIO Writes for Tx Doorbells\n\nThe DQL accounting state which tracks the number of bytes queued for the\nNIC to transmit, namely dql-\u003enum_queued, is updated by the ICE driver\nwhen it invokes __netdev_tx_sent_queue(). Subsequently the driver\nupdates the hardware queue tail allowing the NIC to begin processing the\nwork queue. The queue accounting update should be ordered before the NIC\nbegins transmitting descriptors.\n\nThe transmit path currently updates the hardware doorbell using\nwritel_relaxed(), which (on arm64) does not provide the same ordering\nguarantees between writes to normal memory and writes to MMIO registers\nthat writel() does. This introduces a potential race where the NIC\nbegins transmitting descriptors before the dql-\u003enum_queued update is\nglobally visible. If the NIC finishes before the update is observed by\ndql_completed(), it detects an invalid state where more bytes have been\ncompleted than have been queued. When this happens the following BUG_ON\nis triggered.\n\n  BUG_ON(count \u003e num_queued - dql-\u003enum_completed);\n\nThis has been observed and manifests as the following crash (note that\nthe trace has been trimmed) in an environment with sustained network\nload that uses an Intel Corporation Ethernet Controller E810-XXV for SFP\n(rev 02) on an arm64 machine. Replacing writel_relaxed() with writel()\nin a test kernel eliminated the crash in the user\u0027s workload, which\npreviously reproduced the issue reliably.\n\n  kernel BUG at lib/dynamic_queue_limits.c:99\n\nInternal error: Oops - BUG: 00000000f2000800 [#1] SMP\npc : dql_completed+0x268/0x2a0\nlr : ice_clean_tx_irq+0x1d4/0x620 [ice]\nCall trace:\ndql_completed+0x268/0x2a0 (P)\nice_napi_poll+0x94/0x520 [ice]\n__napi_poll+0x48/0x3f0\nnet_rx_action+0x194/0x420\n\nThis restores the behaviour prior to commit ccde82e90946 (\"ice: add E830\nEarliest TxTime First Offload support\"), which changed the notification\nmechanism from writel() to writel_relaxed()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An unauthenticated IPv4 ICMP Echo Request enters through ice_receive_skb() and ip_rcv(); icmp_echo() copies its payload into a reply that reaches ice_start_xmit()-\u003eice_xmit_frame_ring()-\u003eice_tx_map(), where the fixed doorbell write occurs over routable IP.\nAC:L - On affected arm64 ICE hardware, sustained Echo Requests repeatedly drive both __netdev_tx_sent_queue() and NIC completions until the relaxed-doorbell ordering window occurs; the reported workload reproduced the BUG reliably, and E810 uses the ordinary non-ETF branch.\nPR:N - icmp_rcv() validates protocol state and checksum, while icmp_echo() only checks sysctl_icmp_echo_ignore_all, which defaults to zero; neither path requires authentication, a local account, or a capability.\nUI:N - The attacker alone supplies the Echo Request stream, and the default icmp_echo_ignore_all=0 path automatically constructs and transmits each reply without victim action.\nS:U - The stale dql-\u003enum_queued observation and resulting BUG occur within the same host kernel and ICE device authority; no VM, IOMMU, or other security boundary is crossed.\nC:N - ice_tx_map() creates valid DMA descriptors, and dql_completed() executes BUG_ON immediately after observing stale accounting; there is no out-of-bounds read, use-after-free, or disclosure primitive.\nI:N - The defect only misorders the valid dql-\u003enum_queued store relative to the MMIO doorbell, and the consistency assertion fires before dql_completed() changes its counters; no memory corruption or arbitrary write results.\nA:H - ice_clean_tx_irq()-\u003enetdev_tx_completed_queue()-\u003edql_completed() reaches the explicit BUG_ON in NAPI/NET_RX softirq context, producing the observed arm64 Internal error/Oops and potentially a fatal system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:09:41.904Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b7725acf9c574debb97ae1613569ac9e148438be"
        },
        {
          "url": "https://git.kernel.org/stable/c/f94ab1fffd009250d72c6dc1662cb84467ac5365"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a579dec8423bba7bec96fcfcb2e30838b0858ee"
        }
      ],
      "title": "ice: Restore Ordered MMIO Writes for Tx Doorbells",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98965",
    "datePublished": "2026-10-23T12:19:34.754Z",
    "dateReserved": "2026-09-25T10:25:14.383Z",
    "dateUpdated": "2026-10-24T14:09:41.904Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted