CVE-2025-40185

Vulnerability

In the Linux kernel's ice Ethernet driver, when the ice_adapter_new() function fails, the XArray entry reserved by xa_insert() is not released. This means subsequent attempts to insert an adapter at the same index return -EBUSY, which can lead to a NULL pointer dereference if the kernel assumes the insertion succeeded [1].

Exploitation

Exploitation requires local access to trigger the allocation failure path in ice_adapter_new(). An attacker would need to cause the driver to attempt adapter allocation repeatedly, causing the kernel to dereference a NULL pointer when it uses a stale or missing adapter structure.

Impact

A successful exploitation results in a denial of service (system crash) due to the NULL pointer dereference. The vulnerability does not provide privilege escalation or remote code execution.

Mitigation

The fix reorders the operations: first check if an adapter already exists (xa_load), then reserve the XArray slot (xa_reserve), allocate the adapter, and finally store it (xa_store). This ensures the XArray entry is only reserved after a successful allocation, preventing the leak [1]. The patch has been merged into the Linux kernel stable branches. Users should apply the latest kernel updates.