CVE-2026-97978 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
eth: ice: don't dereference pointers from TP_printk()
After forwarding net-next during the v7.3 merge window we started seeing:
TRACE EVENT ERROR: Event ice_tx_dim_work has double dereference in TP_printk: REC->q_vector->tx.tx_ring->q_index WARNING: kernel/trace/trace_events.c:420 at test_double_dereference.cold+0x39/0x4b
this is due to extra checks added in tracing subsystem in commit b5cc230af5e5 ("tracing: Warn when an event dereferences a pointer in TP_printk()").
Printing happens long after the event was recorded, by which point the pointers may be invalid (the ring or the dim instance). Copy the eight scalars into the event instead.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel vulnerability identified involves a critical flaw within the ice network driver's trace events subsystem, specifically concerning the TP_printk macro usage in the ice_tx_dim_work trace point. This issue manifests as a double dereference error where the tracing infrastructure attempts to access memory structures that are no longer valid at the time of printing. The root cause lies in the asynchronous nature of kernel tracing mechanisms combined with improper pointer handling within the print format definition. When an event is recorded, it captures specific data points for later analysis by user-space tools or internal debuggers. However, if the TP_printk macro relies on dereferencing complex nested pointers to retrieve scalar values at runtime rather than capturing those scalars directly during event recording, it introduces a race condition and potential use-after-free scenario. The kernel's tracing subsystem recently implemented stricter checks via commit b5cc230af5e5 to warn against such practices because printing occurs significantly after the initial event capture by which time the underlying data structures like q_vectors or tx rings may have been freed, reallocated, or otherwise invalidated.
From a technical perspective, this vulnerability represents an unsafe memory access pattern that can lead to kernel panics or system instability if triggered under specific load conditions where trace events are frequently generated and processed concurrently with driver state changes. The error message indicating double dereference in TP_printk highlights that the code was attempting to traverse multiple levels of pointer indirection (REC->q_vector->tx.tx_ring->q_index) during the formatting phase rather than storing the final scalar value directly into the trace buffer. This approach violates best practices for kernel tracing which mandate that all data necessary for an event should be copied into the ring buffer at the moment of occurrence to ensure consistency and safety regardless of subsequent state changes in the driver or hardware context. The vulnerability is classified under CWE-416 Use After Free as it involves accessing memory through pointers that may no longer point to valid objects, potentially leading to information disclosure if arbitrary code execution does not occur due to strict kernel protections like KASLR and SMEP/SMAP.
The operational impact of this flaw primarily affects system stability and debuggability rather than direct remote exploitation or privilege escalation in most standard configurations. However, during high-throughput network operations where the ice driver is actively processing packets and generating trace events for performance monitoring such as Dynamic Interrupt Moderation tuning, the likelihood of triggering invalid pointer dereferences increases significantly. This can result in kernel oops messages, system hangs, or unexpected reboots which disrupt service availability. Furthermore, it undermines the reliability of diagnostic tools that depend on these trace points to analyze network driver behavior and optimize performance parameters like interrupt coalescing settings. Administrators relying on ftrace or perf for deep-dive analysis might encounter corrupted data or crashes when attempting to read these specific events after the patch was not applied.
To mitigate this vulnerability, the recommended action is to apply the upstream kernel fix that modifies the ice driver's trace event definition. The solution involves refactoring the TP_printk macro usage by copying eight scalar values directly into the trace event structure at the time of recording rather than deferring pointer dereferencing until print time. This ensures that all data accessed during printing is stable and contained within the kernel ring buffer, eliminating any dependency on external pointers whose lifetime may have expired. System administrators should update their Linux kernels to versions where this patch has been merged into the mainline or stable trees. Additionally, organizations running custom builds of the ice driver must verify that their trace event definitions adhere to modern tracing standards which prioritize data copying over pointer retention for print functions. Regular auditing of kernel code against CWE-416 and adherence to ATT&CK techniques related to defense evasion through log manipulation can help identify similar patterns in other drivers or subsystems before they manifest as critical stability issues.