UBUNTU-CVE-2026-97979: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ice: add missing xadestroy for schednodeids Commit 16dfa49406bc ("ice: Introduce new parameters in iceschednode") added a schednodeids xarray to the port info structure, but never called xadestroy on it. Since xarrays can allocate internal memory, this can result in a memory leak even if every element in the xarray has been removed. The xarray is currently embedded in the portinfo structure. This appears to have been done because its use is within functions that take the portinfo as a primary argument. However, this complicates managing the lifecycle of the field. The portinfo structure is allocated in iceinithw() using devm, and it is not released until the devm cleanup when the driver is unloaded. The iceinithw() function is called in many places, including devlink reload, and possibly during DDP load after updating the Tx scheduler layout. Adding a call of xadestroy to the icedeinithw() causes Sashiko to raise multiple concerns due to potential ordering issues and possible ways that portinfo could be a dangling reference. To handle this, move the schednodeids out of portinfo and into the hw structure. All users of the array already have a pointer to hw anyways, and there is only one schednodeids per adapter. While here, remove the overly verbose comment explaining the nature of the schednodeids xarray. Add the missing xadestroy to the cleanup path and to icedeinithw(), ensuring that we properly release the xarray memory. This was caught by Sashiko during development of unrelated code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update the ice driver so sched_node_ids is stored in the hw structure rather than port_info, and call xa_destroy for sched_node_ids in the cleanup path and in ice_deinit_hw() to release xarray memory.