The ICE driver on arm64 performs an MMIO write to the NIC doorbell using writel_relaxed, which does not enforce ordering with normal memory writes. A race condition can occur when the NIC starts transmitting descriptors before the driver’s queue‑accounting variable dql->num_queued is globally visible. This triggers the internal BUG_ON and causes the kernel to panic, as observed under sustained network load on an Intel Ethernet E810‑XXV. Based on the description, it is inferred that sustained traffic is required to reliably trigger the crash.

Linux kernel machines on arm64 that load the ICE driver for Intel Corporation Ethernet Controllers E810‑XXV. The flaw exists in kernel versions preceding the patch that restores writel() ordering; no specific version numbers are listed, so any kernel before that commit is potentially vulnerable.

The flaw is a race condition that requires the attacker to generate continuous NIC traffic; the likely attack vector is network traffic from a remote or local user capable of sending large amounts of data to the NIC. The EPSS score is below 1%, indicating a low probability of widespread exploitation, while the CVSS score of 7.5 denotes high severity. The bug can lead to a kernel‑panic denial of service, but the vulnerability is not currently listed in CISA KEV and no public exploit is documented.