CVE-2026-99043: ice: fix metadata_dst refcount handling on representor teardown
In the Linux kernel, the following vulnerability has been resolved:
ice: fix metadatadst refcount handling on representor teardown
iceeswitchreleaserepr() uses metadatadstfree() to release the representor's metadatadst. metadatadstfree() directly frees the underlying memory without checking the dstentry refcount.
When iceeswitchportstartxmit() processes a packet, it takes a reference via dsthold() and attaches the metadatadst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadatadst is freed while references are still held.
Use dstrelease() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadatadst cleanup in dstdestroy() when DSTMETADATA is set.
Other drivers sharing this pattern (nfp, airoha, bnxt) already use dstrelease() for their metadatadst lifecycle.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In ice_eswitch_release_repr(), replace metadata_dst_free() with dst_release() when releasing the representor's metadata_dst, so the dst_entry reference count is decremented correctly.