A NULL pointer dereference occurs during the ice_reset_all_vfs() routine in the Linux kernel. When a VSI rebuild fails—such as during an NVM firmware update via nvmupdate64e—the driver leaves txq_map and rxq_map as NULL. An unconditional call to ice_vf_post_vsi_rebuild() then dereferences this NULL pointer, triggering a kernel panic. The flaw is a classic CWE‑476 condition of using a null pointer, leading to loss of availability by crashing the kernel.

The vulnerability is present in all Linux kernel versions that include the ice driver without the recent fix. Systems that run older kernels and expose the ice_reset_all_vfs() path—particularly those performing NVM firmware updates or driver rebinds—are affected. No specific release numbers are listed, so any kernel prior to the commit that added the null‑check is at risk.

Because the crash requires a failure in the VSI rebuild path, an attacker would need to cause that failure, which typically requires privileged access (e.g., running firmware updates). No EPSS score is available and the issue is not listed in CISA’s KEV catalog, but kernel crashes carry a high severity. The patch only prevents the denial of service; it does not address the root cause of the rebuild failure. Until a kernel containing the fix is deployed, systems remain susceptible to availability loss if the vulnerable code path is invoked.