Security readout for executives and security teams
Plain-English summary
CVE-2026-23117 is a Linux kernel bug in the Intel ice network driver. A devlink reload can leave hardware state uncleared, and later removing the driver can trigger a NULL pointer dereference. The main business risk is host instability or outage on affected systems using this driver.
Executive priority
Treat this as a targeted availability risk for Linux hosts with affected Intel ice networking. Prioritize critical servers and network-sensitive infrastructure, but do not escalate as internet-wide emergency based on current evidence.
Technical view
The regression removed an ice_deinit_hw() call from ice_deinit_dev(). During devlink reinit, ice_devlink_reinit_down() no longer deinitializes hardware, while ice_devlink_reinit_up() still calls ice_init_hw(). Existing control queues can make initialization fail with -EBUSY, followed by a NULL pointer dereference in ice_unload/ice_remove.
Likely exposure
Exposure appears limited to Linux systems using the ice driver, typically Intel Ethernet adapters, where devlink reload and driver removal occur. The source bundle does not provide complete distro package ranges, CVSS, or broad product mapping.
Exploitation context
No active exploitation is reported in the provided sources, and the CVE is not listed as KEV. The described trigger is operational and local to driver lifecycle handling, not a remote network exploit in the supplied evidence.
Researcher notes
The evidence describes a regression in devlink reinit symmetry: deinit was removed on the down path but init remained on the up path. Affected-version detail is commit-oriented and incomplete for distro triage, so validation should rely on kernel source, vendor backports, and advisories.
Mitigation direction
- Apply Linux kernel updates containing the referenced stable fixes.
- Check vendor or distribution advisories for backported kernel packages.
- Avoid unnecessary devlink reload and ice driver removal on suspect systems.
- Prioritize maintenance windows for hosts using the ice driver in critical paths.
Validation and detection
- Inventory Linux hosts using the ice kernel driver.
- Check running kernel packages against distribution advisories for CVE-2026-23117.
- Review logs for ice_init_hw failed errors after devlink reload.
- Confirm updated kernels include the referenced stable commits or vendor backports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23117 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a3d99e2fbf01446d31a0d0dfc46444e915a1f6d4CVE reference, Linux
- https://git.kernel.org/stable/c/42fb5f3deb582cb96440e4683745017dbabb83d6CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.