Linux Kernel ibmvnic Driver NULL Pointer Dereference Vulnerability

A race condition has been identified in the Linux kernel's ibmvnic driver, specifically between the transmit and reset processes. This race can cause the transmit function to access a transmission descriptor that has already been freed, leading to a NULL pointer dereference. The issue arises when the transmit queue is restarted before a reset is fully completed, allowing a transmission to be processed with an invalid descriptor, which can cause a kernel crash.

Impact

Exploitation of this vulnerability leads to a kernel crash due to a NULL pointer dereference, caused by the ibmvnic transmit function accessing a freed transmission descriptor during a reset process.