{"id":"CVE-2026-99044","kind":"vulnerability","aliases":["CVE-2026-99044"],"related":[],"title":"Linux kernel ice driver: use-after-free during dynamic port cleanup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix use-after-free in dynamic port cleanup\n\nice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic\nport from pf->dyn_ports. However, it frees the VSI before reading the\nindex for the erase, resulting in a use-after-free.\n\nFollow the reverse of the allocation order in ice_alloc_dynamic_port()\nby erasing the xarray entry before freeing the VSI.","summary":"The Linux kernel's ice network driver frees a VSI structure before reading its index to remove a dynamic port entry, which is a use-after-free. The sources do not say what an attacker gains from triggering it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ice-driver","intel-ethernet","linux-kernel","runtime"],"not_affected_if":["no-intel-ice-hardware"],"how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the `ice` driver is loaded with `lsmod | grep ice` on hosts with Intel Ethernet adapters\n- unknown whether dynamic ports are reachable by an unprivileged user","fix":"- Update to a kernel release that includes the upstream commit fixing ice dynamic port cleanup (version unknown from the sources)\n- unknown for any other mitigation","status":"open","published_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:10+00:00","updated_at":"2026-10-25T04:54:10+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T04:54:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a kernel release that includes the upstream commit fixing ice dynamic port cleanup (version unknown from the sources)\n- unknown for any other mitigation","reach":"local","title":"Linux kernel ice driver: use-after-free during dynamic port cleanup","impact":"medium","summary":"The Linux kernel's ice network driver frees a VSI structure before reading its index to remove a dynamic port entry, which is a use-after-free. The sources do not say what an attacker gains from triggering it.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ice-driver","intel-ethernet"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; use-after-free in kernel memory could allow crashes or worse","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected kernel version ranges and whether an unprivileged local user can trigger the dynamic port cleanup path.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the `ice` driver is loaded with `lsmod | grep ice` on hosts with Intel Ethernet adapters\n- unknown whether dynamic ports are reachable by an unprivileged user","needs_analyst":true,"not_affected_if":["no-intel-ice-hardware"],"who_is_affected":"Systems running a Linux kernel with the Intel ice driver on hardware that supports dynamic port creation, typically hosts that use the ice driver's dynamic port feature. Hosts without Intel ice hardware or without the driver loaded are not affected. The sources do not say which configurations trigger the cleanup path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000645,"input_tokens":3389,"output_tokens":613,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99044':15A,18A 'alloc':130C,134C 'attack':64B 'cleanup':12A,87C 'cve':13A,16A 'dealloc':89C 'driver':4A,21B,35B 'dyn':93C,104C 'dynam':10A,47B,85C,90C,100C,135C 'entri':49B,141C 'eras':98C,117C,138C 'ethernet':24B 'fix':79C 'follow':73C,125C 'free':8A,36B,56B,83C,108C,124C,143C 'gain':65B 'howev':106C 'ice':3A,20B,33B,78C,88C,133C 'ice-driv':19B 'idx':96C 'index':43B,114C 'intel':23B 'intel-ethernet':22B 'kernel':2A,27B,31B,71C 'linux':1A,26B,30B,70C 'linux-kernel':25B 'network':34B 'order':131C 'pf':103C 'port':11A,48B,86C,91C,94C,101C,105C,136C 'read':41B,112C 'remov':45B 'resolv':77C 'result':118C 'revers':127C 'runtim':28B 'say':61B 'sourc':58B 'structur':39B 'trigger':67B 'use':6A,54B,81C,92C,122C 'use-after-fre':5A,53B,80C,121C 'vsi':38B,95C,110C,145C 'vulner':74C 'xarray':140C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Intel ice driver on hardware that supports dynamic port creation, typically hosts that use the ice driver's dynamic port feature. Hosts without Intel ice hardware or without the driver loaded are not affected. The sources do not say which configurations trigger the cleanup path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99044","severity":null,"published_at":"2026-10-23T13:17:27+00:00","modified_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}