Cloudanix VulnDB

CVE-2026-99043

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A network driver bug can cause computers to crash or become unstable when handling network traffic during certain interface changes.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free caused by calling metadata_dst_free() which bypasses refcount checks, freeing a dst_entry while ice_eswitch_port_start_xmit() still holds references via dst_hold() on queued skbs during representor teardown.

Why it matters to the business

Kernel memory corruption or crashes on systems using affected Intel network drivers under high packet load or when virtual representors are dynamically created and destroyed, leading to network downtime and potential system instability.

How an attack unfolds

An attacker with local access or control over network configuration triggers representor teardown (via interface removal or e-switch reconfiguration) while packets remain queued on a qdisc or lower device, causing the freed metadata_dst to be dereferenced when the skb is later processed.

How to fix it

Apply the upstream kernel fix that replaces metadata_dst_free() with dst_release() in ice_eswitch_release_repr(); rebuild and deploy the patched kernel. Other drivers (nfp, airoha, bnxt) already follow the correct pattern.

How to confirm the fix worked

Confirm the source change in ice_eswitch.c replaces the free call with dst_release(); test by exercising representor create/teardown under packet load and verify no slab corruption or KASAN reports occur.

Typical attack path

  1. Obtain privileges to manage network representors or unload the ice driver module
  2. Ensure packets are queued on the device (e.g., via traffic generation or qdisc configuration)
  3. Trigger ice_eswitch_release_repr() while references are still held
  4. Observe use-after-free when dst metadata is accessed after free

How to detect it

Review kernel logs for use-after-free or KASAN violations mentioning ice_eswitch, metadata_dst, or dst_entry during interface teardown events; correlate with network configuration changes.

What your security team should do

  • Prioritize kernel updates on all systems using the ice driver with e-switch or SR-IOV representors
  • Monitor for kernel oops or use-after-free reports in dmesg related to metadata_dst or ice representors
  • Limit dynamic representor lifecycle operations in production until patched

The record

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata_dst refcount handling on representor teardown ice_eswitch_release_repr() uses metadata_dst_free() to release the representor's metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry refcount. When ice_eswitch_port_start_xmit() processes a packet, it takes a reference via dst_hold() and attaches the metadata_dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata_dst is freed while references are still held. Use dst_release() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set. Other drivers sharing this pattern (nfp, airoha, bnxt) already use dst_release() for their metadata_dst lifecycle.

Affected packages

Ecosystem Package Introduced Fixed