CVE-2026-99044

What it actually does

Use-after-free in ice_dealloc_dynamic_port() where the VSI is freed before its index is read from dyn_port->vsi->idx to perform an xarray erase on pf->dyn_ports.

Why it matters to the business

Kernel memory corruption risk on systems using the ice driver, potentially causing crashes, denial of service, or local privilege escalation; low immediate risk given recent disclosure and minimal exploit activity.

How an attack unfolds

An attacker with the ability to trigger dynamic port allocation and deallocation (typically requiring CAP_NET_ADMIN or equivalent) forces ice_dealloc_dynamic_port() to free the VSI structure before the subsequent index read, allowing the freed memory to be accessed during the xarray erase.

How to fix it

Apply the upstream kernel fix that reverses the deallocation order by erasing the xarray entry before freeing the VSI; update to a patched kernel version containing the commit resolving the dynamic port cleanup ordering.

How to confirm the fix worked

Inspect the ice driver source for the corrected erase-before-free sequence in ice_dealloc_dynamic_port(); verify the running kernel contains the fix via git log or kernel version checks against the published patch.

Typical attack path

1. Obtain privileges sufficient to manage dynamic ports on an ice interface
2. Allocate a dynamic port via ice_alloc_dynamic_port()
3. Trigger deallocation path that reaches ice_dealloc_dynamic_port()
4. Exploit the window where the VSI has been freed but its index is still read
5. Use the resulting use-after-free for memory corruption or information leak

How to detect it

Review kernel logs for ice driver oops or slab-use-after-free warnings around dynamic port functions; examine audit logs for unusual dynamic port allocation/deallocation sequences by privileged processes.

What your security team should do

• Prioritize kernel updates for systems using Intel ice/E800-series adapters within the next patching cycle
• Monitor upstream stable kernel releases and distribution advisories for the fix
• Limit dynamic port usage to trusted administrative contexts until patched