CVE-2026-98965 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
ice: Restore Ordered MMIO Writes for Tx Doorbells
The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql->num_queued, is updated by the ICE driver when it invokes __netdev_tx_sent_queue(). Subsequently the driver updates the hardware queue tail allowing the NIC to begin processing the work queue. The queue accounting update should be ordered before the NIC begins transmitting descriptors.
The transmit path currently updates the hardware doorbell using writel_relaxed(), which (on arm64) does not provide the same ordering guarantees between writes to normal memory and writes to MMIO registers that writel() does. This introduces a potential race where the NIC begins transmitting descriptors before the dql->num_queued update is globally visible. If the NIC finishes before the update is observed by dql_completed(), it detects an invalid state where more bytes have been completed than have been queued. When this happens the following BUG_ON is triggered.
BUG_ON(count > num_queued - dql->num_completed);
This has been observed and manifests as the following crash (note that the trace has been trimmed) in an environment with sustained network load that uses an Intel Corporation Ethernet Controller E810-XXV for SFP (rev 02) on an arm64 machine. Replacing writel_relaxed() with writel() in a test kernel eliminated the crash in the user's workload, which previously reproduced the issue reliably.
kernel BUG at lib/dynamic_queue_limits.c:99
Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
pc : dql_completed+0x268/0x2a0 lr : ice_clean_tx_irq+0x1d4/0x620 [ice]
Call trace: dql_completed+0x268/0x2a0 (P) ice_napi_poll+0x94/0x520 [ice]
__napi_poll+0x48/0x3f0 net_rx_action+0x194/0x420
This restores the behaviour prior to commit ccde82e90946 ("ice: add E830 Earliest TxTime First Offload support"), which changed the notification mechanism from writel() to writel_relaxed().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Intel ICE network driver for Linux kernels contains a concurrency flaw related to memory-mapped I/O write ordering on ARM64 architectures. This vulnerability arises when the transmit path updates hardware doorbells using the writel_relaxed function, which lacks strict ordering guarantees between normal memory writes and MMIO register accesses. Specifically, the Dynamic Queue Limits accounting state tracks bytes queued for transmission via dql->num_queued, but this update must be globally visible before the NIC begins processing descriptors to prevent race conditions that lead to kernel crashes under sustained network load.
The technical root cause lies in the difference between writel and writel_relaxed on ARM64 systems where write combining is enabled or memory barriers are not strictly enforced for MMIO operations. When __netdev_tx_sent_queue updates dql->num_queued, it relies on subsequent hardware doorbell writes to signal the NIC that new work is available. However, because writel_relaxed does not guarantee that prior normal memory stores are visible before the MMIO write completes, the network interface controller may begin transmitting descriptors while the driver's internal accounting state remains stale or inconsistent. This creates a window where the NIC processes data based on outdated queue metrics, leading to logical inconsistencies in byte counting.
The operational impact of this race condition manifests as an immediate kernel panic triggered by a BUG_ON assertion within the dynamic_queue_limits module. The specific failure occurs when dql_completed detects that more bytes have been marked as completed than were originally queued, resulting in a negative count or invalid state calculation. This crash is reproducible under high-throughput network scenarios using Intel E810 series controllers on ARM64 platforms and disrupts system stability by halting the kernel execution path through net_rx_action and ice_clean_tx_irq routines.
To mitigate this vulnerability, the driver must enforce strict ordering between software accounting updates and hardware notifications by replacing writel_relaxed with writel for transmit doorbell operations. This change ensures that all prior memory writes are globally visible before signaling the NIC to process new descriptors, thereby aligning the driver's internal state with actual hardware behavior. The fix restores previous stable behavior lost during earlier refactoring efforts aimed at supporting Earliest TxTime First offload features, effectively eliminating the race condition without impacting performance characteristics on architectures where writel provides necessary synchronization guarantees.