In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which… (CVE-2026-98965)

The Linux kernel ice driver tracks the number of bytes queued for transmission using a DQL accounting state variable dql->num_queued, updated when __netdev_tx_sent_queue() is called. The hardware queue tail is then updated to notify the NIC to begin processing. The vulnerability arose because the transmit path used writel_relaxed() to update the hardware doorbell, which on arm64 does not guarantee ordering between normal memory writes and MMIO register writes. This allowed the NIC to start transmitting descriptors before the accounting update was globally visible, potentially causing the NIC to detect an invalid state where more bytes were completed than queued, triggering a kernel BUG and crash. The fix restored the use of writel() to ensure proper ordering, eliminating the race condition and preventing the crash.

This vulnerability can cause a kernel crash (BUG) on affected systems under sustained network load, specifically on arm64 architectures using Intel Corporation Ethernet Controller E810-XXV hardware. The crash results from a race condition in transmit queue accounting, leading to system instability and potential denial of service due to kernel panics.

A fix is available that restores the use of writel() instead of writel_relaxed() for updating the hardware doorbell in the ice driver, ensuring proper ordering of memory and MMIO writes. Applying the updated Linux kernel version containing this fix will prevent the race condition and associated kernel crashes.