Executive brief
A vulnerability was identified in the Linux kernel's Intel Ethernet 'ice' driver that could lead to a system crash. The issue occurs when the driver fails to properly clear a memory reference after a network transmission error, potentially causing the system to attempt to free the same memory twice when the network interface is shut down. This could impact system stability and availability, particularly in environments using Intel high-speed network adapters.
Technical details
A double-free vulnerability exists in the ice_xmit_frame_ring() function within the Intel 'ice' driver (drivers/net/ethernet/intel/ice/ice_txrx.c). When ice_tso() or ice_tx_csum() fail, the error path frees the socket buffer (skb) but fails to reset the 'first' tx_buf type to ICE_TX_BUF_EMPTY. If the interface is subsequently brought down before another packet overwrites this buffer, ice_clean_tx_ring() attempts to free the already-freed skb. This issue has been resolved by ensuring the buffer type is correctly reset in the error path and moving the initialization of the 'first' descriptor pointer to cover the linearization error path. Patches are available in the stable Linux kernel tree.
Affected products
- Linux Linux 4.17 to 7.1
Timeline
- 2026-04-16: disclosed: Initial patch authored
- 2026-06-24: advisory: CVE-2026-53009 published