Intel ice driver (Ethernet 800 Series, Linux kernel mode): MULTI-TENANT ISOLATION: Kernel-mode flaw in the 800-series

Impact

MULTI-TENANT ISOLATION: Kernel-mode flaw in the 800-series Ethernet Linux driver (a missing check for an exceptional condition) reachable by an authenticated user for privilege escalation. Part of the same 2025 batch - patch them as one unit rather than individually.

Who can reach it

Authenticated local user; tenants on nodes exposing VFs or RDMA devices.

What to do

Fixed in the Intel out-of-tree ice driver (or the equivalent in-kernel version). Updating the driver requires unloading and reloading the module, which drops every link on that NIC - on a node whose RDMA fabric carries collective traffic, that is a job-killing event, so drain first. If you take it via a distro kernel update instead, it is a reboot. No firmware flash for the driver-side fixes. Target ice 1.17.2 or later.

References