Executive brief
A vulnerability was identified in the Linux kernel's Intel 'ice' network driver. This driver manages high-speed Intel Ethernet adapters used in data centers and enterprise networks. An error in how the driver handles failed device activations could lead to a system crash (kernel panic), potentially causing a service outage on the affected server.
Technical details
A double-free vulnerability exists in the ice_sf_eth_activate() function within the Intel 'ice' driver (drivers/net/ethernet/intel/ice/ice_sf_eth.c). When auxiliary_device_add() fails, the code jumps to an error label that calls auxiliary_device_uninit(), which triggers the ice_sf_dev_release() callback to free the sf_dev structure. However, the execution flow then incorrectly falls through to another label that calls kfree(sf_dev) again. This flaw can be triggered during subfunction activation failures, leading to kernel memory corruption or a denial-of-service (system crash). Patches have been released for various stable kernel branches to ensure the function returns immediately after the first free.
Affected products
- Linux Linux Kernel Versions including ice driver with subfunction support
Timeline
- 2026-05-28: advisory: NVD publication date
- 2026-05-14: patched: Committed to stable kernel trees