CVE-2026-97979: ice: add missing xa_destroy for sched_node_ids

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ice: add missing xadestroy for schednodeids

Commit 16dfa49406bc ("ice: Introduce new parameters in iceschednode") added a schednodeids xarray to the port info structure, but never called xadestroy on it.

Since xarrays can allocate internal memory, this can result in a memory leak even if every element in the xarray has been removed.

The xarray is currently embedded in the portinfo structure. This appears to have been done because its use is within functions that take the portinfo as a primary argument.

However, this complicates managing the lifecycle of the field. The portinfo structure is allocated in iceinithw() using devm, and it is not released until the devm cleanup when the driver is unloaded.

The iceinithw() function is called in many places, including devlink reload, and possibly during DDP load after updating the Tx scheduler layout.

Adding a call of xadestroy to the icedeinithw() causes Sashiko to raise multiple concerns due to potential ordering issues and possible ways that portinfo could be a dangling reference.

To handle this, move the schednodeids out of portinfo and into the hw structure. All users of the array already have a pointer to hw anyways, and there is only one schednodeids per adapter. While here, remove the overly verbose comment explaining the nature of the schednodeids xarray.

Add the missing xadestroy to the cleanup path and to icedeinithw(), ensuring that we properly release the xarray memory.

This was caught by Sashiko during development of unrelated code.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    Move the sched_node_ids xarray from port_info into the hw structure, and call xa_destroy on it in the cleanup path and in ice_deinit_hw() to release xarray internal memory.

Event History

Sep 25, 2026
CVE Published
via MITRE·10:23 AM
Data Sourced
via MITRE·10:23 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

Which systems are most likely to accumulate the leaked memory?

Systems using the Linux kernel ice driver are most exposed when ice_init_hw() is invoked repeatedly. The description specifically identifies devlink reload as one such path, and notes that DDP loading after a Tx scheduler layout update may also invoke it.

2

What can be done if the fix cannot be applied immediately?

Minimize repeated devlink reload operations on affected systems, since they can reinitialize the hardware while the port_info allocation remains until the driver is unloaded. Also review workflows that load DDP packages after Tx scheduler layout changes, as this may be another initialization path.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203