CVE-2026-53009: ice: fix double-free of tx_buf skb
In the Linux kernel, the following vulnerability has been resolved:
ice: fix double-free of txbuf skb
If icetso() or icetxcsum() fail, the error path in icexmitframering() frees the skb, but the 'first' txbuf still points to it and is marked as valid (ICETXBUFSKB). 'nexttouse' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the txbuf gets overwritten. But if there is no next packet and the interface is brought down instead, icecleantxring() -> iceunmapandfreetxbuf() will find the txbuf and free the skb for the second time.
The fix is to reset the txbuf type to ICETXBUFEMPTY in the error path, so that iceunmapandfreetxbuf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path.
The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch.
I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN.
I looked for similar bugs in related Intel drivers and did not find any.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53009?
CVE-2026-53009 has a risk rating of 28, indicating a moderate severity level.
How do I fix CVE-2026-53009?
To fix CVE-2026-53009, ensure that you update the Intel ice driver in the Linux kernel to the latest version where the vulnerability is patched.
What systems are affected by CVE-2026-53009?
CVE-2026-53009 affects systems utilizing the Intel ice driver in the Linux kernel.
What does CVE-2026-53009 affect in the Linux kernel?
CVE-2026-53009 addresses a double-free issue of tx_buf skb during error handling in the ice driver.
Is CVE-2026-53009 exploitable?
While specific exploitation details may vary, CVE-2026-53009 can lead to potential memory corruption issues if not mitigated.