CVE-2025-39855 in Linux
Summary
by MITRE • 09/19/2025
In the Linux kernel, the following vulnerability has been resolved:
ice: fix NULL access of tx->in_use in ice_ptp_ts_irq
The E810 device has support for a "low latency" firmware interface to access and read the Tx timestamps. This interface does not use the standard Tx timestamp logic, due to the latency overhead of proxying sideband command requests over the firmware AdminQ.
The logic still makes use of the Tx timestamp tracking structure, ice_ptp_tx, as it uses the same "ready" bitmap to track which Tx timestamps complete.
Unfortunately, the ice_ptp_ts_irq() function does not check if the tracker is initialized before its first access. This results in NULL dereference or use-after-free bugs similar to the following:
[245977.278756] BUG: kernel NULL pointer dereference, address: 0000000000000000
[245977.278774] RIP: 0010:_find_first_bit+0x19/0x40
[245977.278796] Call Trace:
[245977.278809] ? ice_misc_intr+0x364/0x380 [ice]
This can occur if a Tx timestamp interrupt races with the driver reset logic.
Fix this by only checking the in_use bitmap (and other fields) if the tracker is marked as initialized. The reset flow will clear the init field under lock before it tears the tracker down, thus preventing any use-after-free or NULL access.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/22/2025
The vulnerability described in CVE-2025-39855 represents a critical null pointer dereference issue within the Linux kernel's ice driver, specifically affecting Intel E810 network devices that utilize a low latency firmware interface for timestamping operations. This flaw exists in the ice_ptp_ts_irq() function where the driver fails to validate whether the Tx timestamp tracking structure has been properly initialized before accessing its internal fields. The issue manifests when the firmware interface attempts to read Tx timestamps using a specialized low latency mechanism that bypasses standard timestamping logic due to performance concerns related to proxying sideband command requests through the firmware AdminQ. The system continues to leverage the same tracking structure, ice_ptp_tx, which employs a "ready" bitmap to monitor completed Tx timestamps, creating a scenario where uninitialized memory structures can be accessed during interrupt handling.
The technical execution of this vulnerability occurs through a race condition between Tx timestamp interrupts and the driver reset logic, where the interrupt handler attempts to access the tx->in_use field without first verifying that the tracking structure has been properly initialized. This creates a use-after-free or null pointer dereference condition that can result in kernel panics and system crashes. The kernel's call trace demonstrates the failure occurring in the _find_first_bit function, indicating that the dereference happens when attempting to process bitmap operations on what should be a valid memory structure but is instead a null pointer. The root cause stems from the lack of proper initialization checks within the ice_ptp_ts_irq() function, which processes timestamp interrupts for the E810 device's low latency firmware interface.
The operational impact of this vulnerability extends beyond simple system instability, as it can lead to complete system crashes and denial of service conditions in networked environments where the affected Intel E810 devices are deployed. Network operations relying on precise timestamping capabilities become unreliable, potentially affecting real-time applications and services that depend on accurate timing information. The vulnerability affects systems where the ice driver is used with E810 network adapters, particularly in data center and high-performance computing environments where low latency timestamping is critical for network synchronization and performance monitoring. Attackers could potentially exploit this vulnerability to cause persistent system crashes or force system reboots, leading to availability disruptions that could impact business operations and network services.
The fix implemented addresses this vulnerability by introducing proper initialization checks within the ice_ptp_ts_irq() function before accessing any fields of the ice_ptp_tx tracking structure. The solution ensures that bitmap operations and other field accesses only occur when the tracker is marked as initialized, with the reset logic properly clearing the initialization flag under proper locking mechanisms before tearing down the tracker structure. This approach aligns with the principles of secure coding practices and follows the established pattern of defensive programming where resources are validated before use. The mitigation strategy prevents the race condition between interrupt processing and driver reset operations by ensuring that the tracking structure state is properly synchronized, thus eliminating the null pointer dereference conditions that could be exploited by malicious actors or occur during normal system operation. This fix directly addresses the CWE-476_NULL_Pointer_Dereference weakness and helps prevent potential exploitation through the ATT&CK technique of privilege escalation through kernel exploits.