CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path
In the Linux kernel, the following vulnerability has been resolved:
ice: fix double free in icesfethactivate() error path
When auxiliarydeviceadd() fails, icesfethactivate() jumps to auxdevuninit and calls auxiliarydeviceuninit(&sfdev->adev).
The device release callback icesfdevrelease() frees sfdev, but the current error path falls through to sfdevfree and calls kfree(sfdev) again, causing a double free.
Keep kfree(sfdev) for the auxiliarydeviceinit() failure path, but avoid falling through to sfdevfree after auxiliarydeviceuninit().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify ice_sf_eth_activate() so that when auxiliary_device_add()/auxiliary_device_init() fails and auxiliary_device_uninit() (auxiliary_device_uninit(&sf_dev->adev)) is called, the code does not fall through to sf_dev_free. Retain the kfree(sf_dev) call for the auxiliary_device_init() failure path only to prevent a double free.
Linux kernel (ice driver) ice_sf_eth_activate() error path handling = Do not fall through to sf_dev_free after auxiliary_device_uninit(); keep kfree(sf_dev) only for the auxiliary_device_init() failure path.
Event History
Frequently Asked Questions
What conditions are required to trigger the double free?
The issue is reached when ice_sf_eth_activate() calls auxiliary_device_add() and that call fails. The subsequent error handling uninitializes the auxiliary device, whose release callback frees sf_dev, and then incorrectly frees sf_dev a second time.
What level of access does an attacker need?
The supplied CVSS vector rates the attack vector as local and requires low privileges, with no user interaction. It indicates potential high impact to confidentiality, integrity, and availability.
How can I determine whether a system is exposed to the vulnerable error path?
The relevant condition is a failure of auxiliary_device_add() during ice_sf_eth_activate(). Review kernel logs or debugging output for failures in that activation path and confirm whether the installed kernel contains one of the referenced stable fixes.