Live › vulnerability › CVE-2026-99043
Go to dashboardIn the Linux kernel's Intel ice network driver, tearing down a switchdev representor frees its metadata_dst while packets queued on the lower device still reference it. The sources describe a use-after-free style memory safety bug and do not state what an attacker can achieve with it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only hosts with Intel ice-driver NICs that use switchdev mode with representor ports are plausibly exposed, since the bug sits in ice_eswitch_release_repr and the xmit path of representors. Servers with other NICs or with ice but no eswitch representors are unlikely to be affected. The sources do not say how an attacker would reach this code path.
No product ranges from the sources yet.
uname -r and check whether the kernel includes the upstream ice refcount fixlsmod | grep ice and whether switchdev representors are in use (devlink dev eswitch show on the PCI device)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ice: fix metadata_dst refcount handling on representor teardown
ice_eswitch_release_repr() uses metadata_dst_free() to release the representor's metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry refcount.
When ice_eswitch_port_start_xmit() processes a packet, it takes a reference via dst_hold() and attaches the metadata_dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata_dst is freed while references are still held.
Use dst_release() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.
Other drivers sharing this pattern (nfp, airoha, bnxt) already use dst_release() for their metadata_dst lifecycle.
This page as .md · .json · in your agent: get_signal("CVE-2026-99043")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.