Ivan Vecera

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a hang during reboot or shutdown in the Linux kernel. This is caused by a wait-loop added at the beginning of the `iavf remove()` function to ensure port initialization is finished before unregistering the net device. When the `iavf shutdown()` callback is called, it detaches the device, sets it down if running, and changes its state to ` IAVF REMOVE`. Later, the shutdown callback of the associated PF driver (e.g., `ice shutdown`) is called, which indirectly calls `iavf remove()`, leading to an endless loop and a hang in the shutdown process. The patch fixes this by checking the adapter's state at the beginning of `iavf remove()` and skipping the rest of the function if the adapter is already in the remove state. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.19.0 **Description** The vulnerability is related to the i40e driver in the Linux kernel. It causes a kernel crash during module removal due to the incorrect freeing of a client instance. This happens when two offline tests are performed consecutively, leading to an IRDMA driver failure, which is then indicated back to the i40e client subtask() function. This function calls i40e client del instance() to free the client instance, setting the pointer to NULL. However, during module removal, i40e remove() calls i40e lan del device(), which dereferences the NULL pointer, resulting in a crash. To mitigate this issue, it is recommended to avoid removing the client instance when client open callbacks fail and instead clear the I40E CLIENT INSTANCE OPENED bit. Additionally, the driver should handle the situation where the network device is up and the client is not opened in the i40e notify client of netdev close() function, calling the client close callback only when I40E CLIENT INSTANCE OPENED is set. **Recommendations** To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. If an update is not available, consider temporarily disabling the i40e driver or restricting its use to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A race condition vulnerability in the Linux kernel's ice component can cause a dead-lock when an interface leaves and immediately rejoins a LAG. This occurs because the `ice plug aux dev()` function is called from the `ice service task()` context, creating an auxiliary device and taking the associated device lock, while the `ice unplug aux dev()` function, called by the notifier under RTNL lock, attempts to take the same lock, resulting in a dead-lock. The vulnerability can be exploited by an attacker to cause a denial-of-service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.