All vulnerabilities
CVE-2026-99044

Linux: ice: fix use-after-free in dynamic port cleanup

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 24 Oct 2026FIRST EPSS
Fixed in7c1344df1ae0579f57b97647e5203b06496ce10cAlso 1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ffCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 7c1344df1ae0579f57b97647e5203b06496ce10cLinuxCVE List
  • 1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ffLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ice: fix use-after-free in dynamic port cleanup

ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic port from pf->dyn_ports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-free.

Follow the reverse of the allocation order in ice_alloc_dynamic_port() by erasing the xarray entry before freeing the VSI.

Text from CVE List

Affected versions 10

  • Linuxaffected: eda69d654c7edae21312f731e0308941cb2ee2a9 before 7c1344df1ae0579f57b97647e5203b06496ce10cCVE List
  • Linuxaffected: eda69d654c7edae21312f731e0308941cb2ee2a9 before ca8a6285b11d01e5a279b1aa7fb55b1a02ecebb1CVE List
  • Linuxaffected: eda69d654c7edae21312f731e0308941cb2ee2a9 before b98eb58ba2f8fe8e9bba1b8a3b94fa5602c6de84CVE List
  • Linuxaffected: eda69d654c7edae21312f731e0308941cb2ee2a9 before 1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ffCVE List
  • Linuxaffected: 6.12CVE List
  • Linuxunaffected: all versions before 6.12CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4