Vulnerability feed

Executive summary

A use-after-free bug was fixed in the Linux kernel's Intel ice network driver, in the code that cleans up dynamic ports. The advisory describes the fix as reordering two cleanup steps so the driver no longer reads memory after it has been freed. The advisory does not state a severity rating, and it does not describe any workaround beyond applying the kernel fix.

Technical summary

The flaw is a use-after-free in ice_dealloc_dynamic_port(), where the driver freed the VSI before reading its index to erase the dynamic port from pf->dyn_ports. The fix moves the xa_erase call ahead of ice_vsi_free, following the reverse of the allocation order. The advisory names the commit that fixes it and lists the fixed-in kernel version only as the commit itself; no affected or fixed kernel version range is stated. Attack vector, required privileges, and exploitability are not stated, and no CVSS score is given. No workaround or detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/1402fc67d2f4e2e…f8ee0825b8ad994557ff

Score

No CVSS score published.

Affects

LinuxIntelLinuxLinux kernelIntel ice

Executive summary

The advisory describes a flaw in the Linux kernel's Intel ice network driver, specifically in how it releases metadata objects when a virtual port representor is torn down. The advisory does not state a severity rating, and it describes the change as a reference-counting fix that the kernel stable tree has applied.

Technical summary

The flaw is a reference-counting error in the ice driver's representor teardown path, where metadata_dst_free() frees the object without checking its dst_entry refcount, so the object can be freed while packets still hold references, such as packets queued in a qdisc on the lower device. The fix replaces metadata_dst_free() with dst_release() in ice_eswitch_release_repr(), and the diff shows this change in ice_eswitch_release_reprs() in drivers/net/ethernet/intel/ice/ice_eswitch.c. The advisory states the fix is tagged for stable and references the upstream commit 58858b8f14803a7eeac297b3ce20f3b21bf2ff66, but it does not state the affected or fixed kernel version numbers, a CVSS score, a workaround, exploitation status, or the attack vector beyond the queued-packet precondition. Detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/1f263235651775f…d90c9f25c3f4a4ef6512

Score

No CVSS score published.

Affects

LinuxIntelLinuxLinux kernelIntel ice