Vulnerability feed

Executive summary

A use-after-free bug was fixed in the Linux kernel's Intel ice network driver, in the code that cleans up dynamic ports. The advisory describes the fix as reordering two cleanup steps so the driver no longer reads memory after it has been freed. The advisory does not state a severity rating, and it does not describe any workaround beyond applying the kernel fix.

Technical summary

The flaw is a use-after-free in ice_dealloc_dynamic_port(), where the driver freed the VSI before reading its index to erase the dynamic port from pf->dyn_ports. The fix moves the xa_erase call ahead of ice_vsi_free, following the reverse of the allocation order. The advisory names the commit that fixes it and lists the fixed-in kernel version only as the commit itself; no affected or fixed kernel version range is stated. Attack vector, required privileges, and exploitability are not stated, and no CVSS score is given. No workaround or detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/1402fc67d2f4e2e…f8ee0825b8ad994557ff

Score

No CVSS score published.

Affects

LinuxIntelLinuxLinux kernelIntel ice

Executive summary

The advisory describes a flaw in the Linux kernel's Intel ice network driver, specifically in how it releases metadata objects when a virtual port representor is torn down. The advisory does not state a severity rating, and it describes the change as a reference-counting fix that the kernel stable tree has applied.

Technical summary

The flaw is a reference-counting error in the ice driver's representor teardown path, where metadata_dst_free() frees the object without checking its dst_entry refcount, so the object can be freed while packets still hold references, such as packets queued in a qdisc on the lower device. The fix replaces metadata_dst_free() with dst_release() in ice_eswitch_release_repr(), and the diff shows this change in ice_eswitch_release_reprs() in drivers/net/ethernet/intel/ice/ice_eswitch.c. The advisory states the fix is tagged for stable and references the upstream commit 58858b8f14803a7eeac297b3ce20f3b21bf2ff66, but it does not state the affected or fixed kernel version numbers, a CVSS score, a workaround, exploitation status, or the attack vector beyond the queued-packet precondition. Detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/1f263235651775f…d90c9f25c3f4a4ef6512

Score

No CVSS score published.

Affects

LinuxIntelLinuxLinux kernelIntel ice

Executive summary

A flaw in the Linux kernel's Intel i915 graphics driver can cause the kernel to free memory outside the intended buffer during command submission. The advisory text does not state a severity rating or real-world exploitation, and it describes this as a fix in the stable tree.

Technical summary

The flaw is in the drm/i915 GEM execbuffer code, where eb_relocate_parse_slow() can call kvfree() on entries beyond the original exec array because the cleanup path uses an incremented buffer_count that includes VMAs appended by the command parser, which is a memory safety (out-of-bounds) issue. The advisory does not state the attack vector, required privileges, or exploitation conditions. The fix changes the cleanup to use the original exec object count captured before VMAs are appended. Affected and fixed version numbers are not stated, though the commit is cherry-picked to stable and the Cc line references kernel 5.10+. No workarounds or detection guidance are stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/152fb5083b9333a…29572f9e0f276a404ba6

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxIntelLinuxLinux kernelIntel i915

Executive summary

The advisory describes a fix in the Linux kernel's Intel i915 graphics driver, in the GT power management code. A race condition could cause the driver to touch hardware while the runtime power wakelock was not held, which the kernel reports and taints itself for. The advisory does not state a severity rating, and the fix is a kernel patch that skips an interrupt unmask when the GPU is no longer active.

Technical summary

The flaw is a race condition in the drm/i915 GT render power management code, where rps_work() could run after the GT was parked and unmask RPS PM interrupts without the runtime PM wakelock held. The advisory describes this as observed during the live_rc6_ctx_wa() selftest, and it does not describe a remote attack vector or required preconditions beyond the timing race. The fix skips the unmask when RPS is no longer active, and it is described as a cherry-picked commit ca4a6deadad15b91ee083afe445fa6bdbfb68206. Affected and fixed kernel version ranges are not stated in the advisory, and no workaround is stated. No detection guidance or CVSS score is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Score

No CVSS score published.

Affects

LinuxIntelLinuxLinux kernelIntel i915

Executive summary

The advisory describes a race condition in the Linux kernel's Intel ICE network driver, which supports Intel Ethernet Controller E810 adapters. Under sustained network load on arm64 machines, this can crash the kernel. The advisory does not state a severity rating, and it describes a fix that restores ordered register writes in the transmit path.

Technical summary

The flaw is a memory ordering issue in the ice driver transmit path, where the tail doorbell is written with writel_relaxed() rather than writel(). On arm64, this can let the NIC start transmitting before the dynamic queue limit (DQL) byte count update is visible, which triggers a BUG_ON in dql_completed() and a kernel crash. The advisory describes the trigger as sustained network load on an Intel Ethernet Controller E810-XXV for SFP (rev 02) system, and states that the crash was reproduced reliably by the user. The fix restores writel() in the transmit doorbell path, reverting the change made in commit ccde82e90946. The advisory does not state affected or fixed version numbers, CVSS score, attack vector or privileges required, workarounds, or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affects

LinuxIntelLinuxLinux kernelIntel Ethernet Controller E810-XXV for SFP

Executive summary

A fix in the Linux kernel's Intel wireless driver (iwlwifi, mvm component) addresses a flaw in how scheduled Wi-Fi scans handle oversized information elements, which could overflow a fixed buffer. The advisory does not state a severity rating for this issue. The advisory shows a stable-tree commit that corrects the ordering of length validation and reports the change, but it does not give explicit upgrade instructions.

Technical summary

The flaw is a buffer handling problem: the scheduled scan code built the probe request before the length check (iwl_mvm_scan_fits), so oversized information elements could be copied into a fixed-size buffer before validation. The fix moves iwl_mvm_build_scan_probe() after the fits check and changes max_sched_scan_ie_len to use iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes. The advisory does not state the attack vector, required privileges, or preconditions. It does not state affected or fixed kernel version numbers, a CVSS score, workarounds, or exploitation status, and no detection guidance is given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/05f79cea3b15cfe…05ddcfd51ebee15d908a

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxIntelLinuxLinux kernelIntel iwlwifi

Executive summary

This advisory describes a fix in the Linux kernel's iwlwifi wireless driver for Intel wireless adapters (mld component). A kernel warning was triggered when a system suspended with Wake-on-WLAN configured while not connected to a network. The advisory does not state a severity rating, and the vendor-style fix removes the warning and lets the system suspend normally.

Technical summary

The flaw is a WARN_ON() check in the iwlwifi mld driver's WoWLAN suspend path (iwl_mld_wowlan_suspend in d3.c) that fired when the device was not associated and no netdetect configuration was present. The fix removes the WARN_ON() and continues to return 1 so the driver disconnects and suspends. The advisory does not state the attack vector, preconditions for exploitation beyond this suspend scenario, a CVSS score, affected or fixed kernel version numbers, workarounds, or whether exploitation has been observed. Detection guidance is not stated. The fix is shown as a commit to the stable tree dated 2026-06-03 in the commit metadata.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/301b0dfa9db3f1e…95e803bbd88fbd878c7c

Score

No CVSS score published.

Affects

LinuxIntelLinuxLinux kernelIntel iwlwifi