Executive brief
A vulnerability in the Intel 'ice' network driver for the Linux kernel can cause memory leaks when handling large network packets (jumbo frames). This occurs because the system fails to properly release memory pages when receiving certain types of multi-buffer data. Over time, this can lead to system instability, performance degradation, or a complete service outage as available memory is exhausted.
Technical details
A vulnerability in the ice_put_rx_mbuf() function of the Intel 'ice' driver leads to an Rx page leak. The root cause is a logic error where the driver iterates over fragments based on a cached count; if the hardware posts a descriptor with a size of 0, that descriptor is skipped during fragment addition but still occupies a slot in the ring. Because the loop fails to reach these skipped descriptors, ice_put_rx_buf() is never called, preventing the page from being freed or reused. This results in stale pages remaining in the ring and potential memory exhaustion. The fix involves changing the iteration logic to use the ring index (next_to_clean) rather than a fragment count.
Affected products
- Linux Linux Kernel 6.12.14 to 6.12.49, and other versions prior to fixes in 80555adb, 84bf1ac8, fcb5718e
Timeline
- 2025-08-25: other: Patch authored
- 2025-10-04: disclosed: CVE published