All vulnerabilities
CVE-2026-99043

Linux: ice: fix metadata_dst refcount handling on representor teardown

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 24 Oct 2026FIRST EPSS
Fixed in1f263235651775f93c15d90c9f25c3f4a4ef6512Also 6f5544f53f1e58ea8a49fb9f9158d5793b9205b0, 5e4d20db5179e83a4948927bc39e489a9a83256d and 1 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 1f263235651775f93c15d90c9f25c3f4a4ef6512LinuxCVE List
  • 6f5544f53f1e58ea8a49fb9f9158d5793b9205b0LinuxCVE List
  • 5e4d20db5179e83a4948927bc39e489a9a83256dLinuxCVE List
  • 58858b8f14803a7eeac297b3ce20f3b21bf2ff66LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ice: fix metadata_dst refcount handling on representor teardown

ice_eswitch_release_repr() uses metadata_dst_free() to release the representor's metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry refcount.

When ice_eswitch_port_start_xmit() processes a packet, it takes a reference via dst_hold() and attaches the metadata_dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata_dst is freed while references are still held.

Use dst_release() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.

Other drivers sharing this pattern (nfp, airoha, bnxt) already use dst_release() for their metadata_dst lifecycle.

Text from CVE List

Affected versions 12

  • Linuxaffected: f5396b8a663f7a78ee5b75a47ee524b40795b265 before 1f263235651775f93c15d90c9f25c3f4a4ef6512CVE List
  • Linuxaffected: f5396b8a663f7a78ee5b75a47ee524b40795b265 before 6f5544f53f1e58ea8a49fb9f9158d5793b9205b0CVE List
  • Linuxaffected: f5396b8a663f7a78ee5b75a47ee524b40795b265 before beb05f484a1e4a5a66e3678e4b7f3147f651c080CVE List
  • Linuxaffected: f5396b8a663f7a78ee5b75a47ee524b40795b265 before 5e4d20db5179e83a4948927bc39e489a9a83256dCVE List
  • Linuxaffected: f5396b8a663f7a78ee5b75a47ee524b40795b265 before 58858b8f14803a7eeac297b3ce20f3b21bf2ff66CVE List
  • Linuxaffected: 5.16CVE List
  • Linuxunaffected: all versions before 5.16CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5