CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
In the Linux kernel, the following vulnerability has been resolved:
ice: fix FDIR CTRL VSI resource leak in iceresetallvfs()
Resetting all VFs causes resource leak on VFs with FDIR filters enabled as CTRL VSIs are only invalidated and not freed. Fix by using icevfctrlvsirelease() instead of icevfctrlinvalidatevsi() which aligns behavior with the iceresetvf() function.
Reproduction: echo 1 > /sys/class/net/$pf/device/sriovnumvfs ethtool -N $vf flow-type ether proto 0x9000 action 0 echo 1 > /sys/class/net/$pf/device/reset
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (ice driver)to a version that resolves this vulnerability.Patch ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - Configuration
Disable the specified FDIR rule on the VF using: ethtool -N $vf flow-type ether proto 0x9000 action 0.
ethtool (VF FDIR) flow-type ether proto 0x9000 action 0 = 0 - Compensating control
Use the provided VF reset sequence: echo 1 > /sys/class/net/$pf/device/reset followed by echo 1 > /sys/class/net/$pf/device/sriov_numvfs (noting: this keeps behavior aligned by only invalidating, not freeing, CTRL VSIs).