NULL Pointer Dereference Affecting kernel-modules-extra-matched package, versions <0:6.12.0-211.7.1.el10_2
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL10-KERNELMODULESEXTRAMATCHED-16762164
- published20 May 2026
- disclosed14 Feb 2026
Introduced: 14 Feb 2026
CVE-2026-23210 (opens in a new tab)How to fix?
Upgrade RHEL:10 kernel-modules-extra-matched to version 0:6.12.0-211.7.1.el10_2 or higher.
This issue was patched in RHSA-2026:18134.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-modules-extra-matched package and not the kernel-modules-extra-matched package as distributed by RHEL.
See How to fix? for RHEL:10 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
ice: Fix PTP NULL pointer dereference during VSI rebuild
Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings.
The sequence was:
- ice_ptp_prepare_for_reset() cancels PTP work
- ice_ptp_rebuild() immediately queues PTP work
- VSI rebuild happens AFTER ice_ptp_rebuild()
- PTP work runs and accesses NULL vsi->rx_rings
Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild().
Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY.
Error log: [ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: error_code(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=CPU_OUT_OF_SPEC [ 121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] <TASK> [ 121.393055] ice_ptp_periodic_work+0x69/0x180 [ice] [ 121.393202] kthread_worker_fn+0xa2/0x260 [ 121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice] [ 121.393359] ? __pfx_kthread_worker_fn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? __pfx_kthread+0x10/0x10 [ 121.393393] ret_from_fork+0x273/0x2b0 [ 121.393407] ? __pfx_kthread+0x10/0x10 [ 121.393417] ret_from_fork_asm+0x1a/0x30 [ 121.393432] </TASK>
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2439895
- https://access.redhat.com/security/cve/CVE-2026-23210
- https://access.redhat.com/errata/RHSA-2026:18134
- https://access.redhat.com/errata/RHSA-2026:22334
- https://git.kernel.org/stable/c/7565d4df66b6619b50dc36618d8b8f1787d77e19
- https://git.kernel.org/stable/c/fc6f36eaaedcf4b81af6fe1a568f018ffd530660
- https://git.kernel.org/stable/c/ba0c7fff6616025a7d3a9e887e7ce16b06dc34b9