{
  "cveId": "CVE-2026-23353",
  "url": "https://patchblox.com/security/cve/CVE-2026-23353",
  "summary": "CVE-2026-23353 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23353 (version 6.19.8-1), released March 25, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ice: fix crash in ethtool offline loopback test...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ice: fix crash in ethtool offline loopback test  Since the conversion of ice to page pool, the ethtool loopback test crashes:   BUG: kernel NULL pointer dereference, address: 000000000000000c  #PF: supervisor write access in kernel mode  #PF: error_code(0x0002) - not-present page  PGD 1100f1067 P4D 0  Oops: Oops: 0002 [#1] SMP NOPTI  CPU: 23 UID: 0 PID: 5904 Comm: ethtool Kdump: loaded Not tainted 6.19.0-0.rc7.260128g1f97d9dcf5364.49.eln154.x86_64 #1 PREEMPT(lazy)  Hardware name: [...]  RIP: 0010:ice_alloc_rx_bufs\u002B0x1cd/0x310 [ice]  Code: 83 6c 24 30 01 66 41 89 47 08 0f 84 c0 00 00 00 41 0f b7 dc 48 8b 44 24 18 48 c1 e3 04 41 bb 00 10 00 00 48 8d 2c 18 8b 04 24 \u003C89\u003E 45 0c 41 8b 4d 00 49 d3 e3 44 3b 5c 24 24 0f 83 ac fe ff ff 44  RSP: 0018:ff7894738aa1f768 EFLAGS: 00010246  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000  RDX: 0000000000000000 RSI: 0000000000000700 RDI: 0000000000000000  RBP: 0000000000000000 R08: ff16dcae79880200 R09: 0000000000000019  R10: 0000000000000001 R11: 0000000000001000 R12: 0000000000000000  R13: 0000000000000000 R14: 0000000000000000 R15: ff16dcae6c670000  FS:  00007fcf428850c0(0000) GS:ff16dcb149710000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 000000000000000c CR3: 0000000121227005 CR4: 0000000000773ef0  PKRU: 55555554  Call Trace:   \u003CTASK\u003E   ice_vsi_cfg_rxq\u002B0xca/0x460 [ice]   ice_vsi_cfg_rxqs\u002B0x54/0x70 [ice]   ice_loopback_test\u002B0xa9/0x520 [ice]   ice_self_test\u002B0x1b9/0x280 [ice]   ethtool_self_test\u002B0xe5/0x200   __dev_ethtool\u002B0x1106/0x1a90   dev_ethtool\u002B0xbe/0x1a0   dev_ioctl\u002B0x258/0x4c0   sock_do_ioctl\u002B0xe3/0x130   __x64_sys_ioctl\u002B0xb9/0x100   do_syscall_64\u002B0x7c/0x700   entry_SYSCALL_64_after_hwframe\u002B0x76/0x7e   [...]  It crashes because we have not initialized libeth for the rx ring.  Fix it by treating ICE_VSI_LB VSIs slightly more like normal PF VSIs and letting them have a q_vector. It\u0027s just a dummy, because the loopback test does not use interrupts, but it contains a napi struct that can be passed to libeth_rx_fq_create() called from ice_vsi_cfg_rxq() -\u003E ice_rxq_pp_create().",
  "published": "2026-03-25T11:16:33Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00131,
  "epssPercentile": 0.02716,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.19.8-1",
      "fix": "DEBIAN-CVE-2026-23353",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23353",
      "released": "2026-03-25T11:16:33Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}