{"id":"CVE-2026-99043","kind":"vulnerability","aliases":["CVE-2026-99043"],"related":[],"title":"Linux kernel ice driver: representor teardown can free packets' metadata too early","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix metadata_dst refcount handling on representor teardown\n\nice_eswitch_release_repr() uses metadata_dst_free() to release the\nrepresentor's metadata_dst.  metadata_dst_free() directly frees the\nunderlying memory without checking the dst_entry refcount.\n\nWhen ice_eswitch_port_start_xmit() processes a packet, it takes a\nreference via dst_hold() and attaches the metadata_dst to the skb.\nIf the representor is torn down while packets are still queued on\nthe lower device (e.g. in a qdisc), the metadata_dst is freed while\nreferences are still held.\n\nUse dst_release() instead, which correctly decrements the refcount\nand only frees the object when all references are dropped.  The dst\nsubsystem already handles metadata_dst cleanup in dst_destroy() when\nDST_METADATA is set.\n\nOther drivers sharing this pattern (nfp, airoha, bnxt) already use\ndst_release() for their metadata_dst lifecycle.","summary":"In the Linux kernel's Intel ice network driver, tearing down a switchdev representor frees its metadata_dst while packets queued on the lower device still reference it. The sources describe a use-after-free style memory safety bug and do not state what an attacker can achieve with it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","intel-ice","kernel","linux","sr-iov","switchdev"],"not_affected_if":["no-intel-ice-nic","no-switchdev-representors"],"how_to_check":"- Run `uname -r` and check whether the kernel includes the upstream ice refcount fix\n- Check whether the ice driver is loaded with `lsmod | grep ice` and whether switchdev representors are in use (`devlink dev eswitch show` on the PCI device)","fix":"- Update the Linux kernel to a release that includes the upstream commit 'ice: fix metadata_dst refcount handling on representor teardown' once distributions ship it\n- Check your distribution's advisory for the exact fixed kernel version, which the sources do not give","status":"open","published_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:13+00:00","updated_at":"2026-10-25T04:54:13+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T04:54:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'ice: fix metadata_dst refcount handling on representor teardown' once distributions ship it\n- Check your distribution's advisory for the exact fixed kernel version, which the sources do not give","reach":"local","title":"Linux kernel ice driver: representor teardown can free packets' metadata too early","impact":"medium","summary":"In the Linux kernel's Intel ice network driver, tearing down a switchdev representor frees its metadata_dst while packets queued on the lower device still reference it. The sources describe a use-after-free style memory safety bug and do not state what an attacker can achieve with it.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","intel-ice","sr-iov","switchdev"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the kernel is possible","analyst_note":"Check the NVD entry and the upstream kernel commit to confirm the exploit primitive, the trigger conditions and the fixed kernel versions.","how_to_check":"- Run `uname -r` and check whether the kernel includes the upstream ice refcount fix\n- Check whether the ice driver is loaded with `lsmod | grep ice` and whether switchdev representors are in use (`devlink dev eswitch show` on the PCI device)","needs_analyst":true,"not_affected_if":["no-intel-ice-nic","no-switchdev-representors"],"who_is_affected":"Only hosts with Intel ice-driver NICs that use switchdev mode with representor ports are plausibly exposed, since the bug sits in ice_eswitch_release_repr and the xmit path of representors. Servers with other NICs or with ice but no eswitch representors are unlikely to be affected. The sources do not say how an attacker would reach this code path.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000696,"input_tokens":3563,"output_tokens":680,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99043':15A,18A 'achiev':77B 'airoha':220C 'alreadi':201C,222C 'attach':143C 'attack':75B 'bnxt':221C 'bug':68B 'check':121C 'cleanup':205C 'correct':184C 'cve':13A,16A 'decrement':185C 'describ':59B 'destroy':208C 'devic':53B,164C 'direct':115C 'driver':4A,37B,215C 'drop':197C 'dst':46B,91C,103C,111C,113C,123C,140C,146C,171C,180C,199C,204C,207C,210C,224C,229C 'e.g':165C 'earli':12A 'entri':124C 'eswitch':98C,128C 'fix':89C 'follow':83C 'free':8A,43B,64B,104C,114C,116C,190C 'freed':173C 'handl':93C,202C 'held':178C 'hold':141C 'ice':3A,22B,35B,88C,97C,127C 'infrastructur':19B 'instead':182C 'intel':21B,34B 'intel-ic':20B 'iov':27B 'kernel':2A,23B,32B,81C 'lifecycl':230C 'linux':1A,24B,31B,80C 'lower':52B,163C 'memori':66B,119C 'metadata':10A,45B,90C,102C,110C,112C,145C,170C,203C,211C,228C 'network':36B 'nfp':219C 'object':192C 'packet':9A,48B,134C,157C 'pattern':218C 'port':129C 'process':132C 'qdisc':168C 'queu':49B,160C 'refcount':92C,125C,187C 'refer':55B,138C,175C,195C 'releas':99C,106C,181C,225C 'repr':100C 'representor':5A,42B,95C,108C,152C 'resolv':87C 'safeti':67B 'set':213C 'share':216C 'skb':149C 'sourc':58B 'sr':26B 'sr-iov':25B 'start':130C 'state':72B 'still':54B,159C,177C 'style':65B 'subsystem':200C 'switchdev':28B,41B 'take':136C 'tear':38B 'teardown':6A,96C 'torn':154C 'under':118C 'use':62B,101C,179C,223C 'use-after-fre':61B 'via':139C 'vulner':84C 'without':120C 'xmit':131C","nicknames":[],"mitigations":[],"who_affected":"Only hosts with Intel ice-driver NICs that use switchdev mode with representor ports are plausibly exposed, since the bug sits in ice_eswitch_release_repr and the xmit path of representors. Servers with other NICs or with ice but no eswitch representors are unlikely to be affected. The sources do not say how an attacker would reach this code path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99043","severity":null,"published_at":"2026-10-23T13:17:27+00:00","modified_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}