|
Vulnerabilities
< Back

CVE-2026-53009

Updated on 24 Jun 2026

Severity

7.0 High severity

Details

CVSS score
7.0
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

ice: fix double-free of tx_buf skb

If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the ‘first’ tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). ’next_to_use’ remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time.

The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of ‘first’ up, to ensure it’s already valid in case we hit the linearization error path.

The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch.

I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN.

I looked for similar bugs in related Intel drivers and did not find any.

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 7 ELS , Debian 10 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , TuxCare 9.6 ESU , Ubuntu 20.04 ELS
Affected packages:
kernel @ 5.14.0 (+12 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 10 Released
52 kernels
  • 6.12.0-55.27.1.el10_0
  • 6.12.0-55.28.1.el10_0
  • 6.12.0-55.29.1.el10_0
  • 6.12.0-55.30.1.el10_0
  • 6.12.0-55.31.1.el10_0
  • 6.12.0-55.32.1.el10_0
  • 6.12.0-55.33.1.el10_0
  • 6.12.0-55.34.1.el10_0
  • 6.12.0-55.37.1.el10_0
  • 6.12.0-55.38.1.el10_0
  • 6.12.0-55.39.1.el10_0
  • 6.12.0-55.40.1.el10_0
  • 6.12.0-55.42.1.el10_0
  • 6.12.0-55.43.1.el10_0
  • 6.12.0-124.8.1.el10_1
  • 6.12.0-124.13.1.el10_1
  • 6.12.0-124.16.1.el10_1
  • 6.12.0-124.20.1.el10_1
  • 6.12.0-124.21.1.el10_1
  • 6.12.0-124.27.1.el10_1
  • 6.12.0-124.28.1.el10_1
  • 6.12.0-124.29.1.el10_1
  • 6.12.0-124.31.1.el10_1
  • 6.12.0-124.35.1.el10_1
  • 6.12.0-124.38.1.el10_1
  • 6.12.0-124.39.1.el10_1
  • 6.12.0-124.43.1.el10_1
  • 6.12.0-124.45.1.el10_1
  • 6.12.0-124.47.1.el10_1
  • 6.12.0-124.49.1.el10_1
  • 6.12.0-124.52.1.el10_1
  • 6.12.0-124.55.1.el10_1
  • 6.12.0-124.40.1.el10_1
  • 6.12.0-124.52.2.el10_1
  • 6.12.0-124.52.3.el10_1
  • 6.12.0-211.7.1.el10_2
  • 6.12.0-211.7.3.el10_2
  • 6.12.0-124.56.5.el10_1
  • 6.12.0-124.55.3.el10_1
  • 6.12.0-211.20.1.el10_2
  • 6.12.0-211.18.1.el10_2
  • 6.12.0-211.16.1.el10_2
  • 6.12.0-211.22.1.el10_2
  • 6.12.0-211.26.1.el10_2
  • 6.12.0-211.28.1.el10_2
  • 6.12.0-211.29.1.el10_2
  • 6.12.0-211.30.1.el10_2
  • 6.12.0-211.31.1.el10_2
  • 6.12.0-211.32.1.el10_2
  • 6.12.0-211.7.4.el10_2
  • 6.12.0-211.33.1.el10_2
  • 6.12.0-211.34.1.el10_2
Oracle Linux 10 Released
37 kernels
  • 6.12.0-55.27.1.0.1.el10_0
  • 6.12.0-55.28.1.0.1.el10_0
  • 6.12.0-55.29.1.0.1.el10_0
  • 6.12.0-55.30.1.0.1.el10_0
  • 6.12.0-55.31.1.0.1.el10_0
  • 6.12.0-55.32.1.0.1.el10_0
  • 6.12.0-55.33.1.0.1.el10_0
  • 6.12.0-55.34.1.0.1.el10_0
  • 6.12.0-55.37.1.0.1.el10_0
  • 6.12.0-55.38.1.0.1.el10_0
  • 6.12.0-55.39.1.0.1.el10_0
  • 6.12.0-55.40.1.0.1.el10_0
  • 6.12.0-55.41.1.0.1.el10_0
  • 6.12.0-55.42.1.0.1.el10_0
  • 6.12.0-55.43.1.0.1.el10_0
  • 6.12.0-124.8.1.el10_1
  • 6.12.0-124.13.1.el10_1
  • 6.12.0-124.16.1.el10_1
  • 6.12.0-124.20.1.el10_1
  • 6.12.0-124.21.1.el10_1
  • 6.12.0-124.27.1.el10_1
  • 6.12.0-124.28.1.el10_1
  • 6.12.0-124.29.1.el10_1
  • 6.12.0-124.31.1.el10_1
  • 6.12.0-124.35.1.el10_1
  • 6.12.0-124.38.1.el10_1
  • 6.12.0-124.39.1.el10_1
  • 6.12.0-124.40.1.el10_1
  • 6.12.0-124.43.1.el10_1
  • 6.12.0-124.45.1.el10_1
  • 6.12.0-124.47.1.el10_1
  • 6.12.0-124.49.1.el10_1
  • 6.12.0-124.52.1.el10_1
  • 6.12.0-124.55.1.el10_1
  • 6.12.0-124.56.1.el10_1
  • 6.12.0-211.7.3.el10_2
  • 6.12.0-211.34.1.el10_2
RHEL 10 Released
51 kernels
  • 6.12.0-55.27.1.el10_0
  • 6.12.0-55.28.1.el10_0
  • 6.12.0-55.29.1.el10_0
  • 6.12.0-55.30.1.el10_0
  • 6.12.0-55.31.1.el10_0
  • 6.12.0-55.32.1.el10_0
  • 6.12.0-55.33.1.el10_0
  • 6.12.0-55.34.1.el10_0
  • 6.12.0-55.37.1.el10_0
  • 6.12.0-55.38.1.el10_0
  • 6.12.0-55.39.1.el10_0
  • 6.12.0-55.40.1.el10_0
  • 6.12.0-55.41.1.el10_0
  • 6.12.0-55.42.1.el10_0
  • 6.12.0-55.43.1.el10_0
  • 6.12.0-124.9.1.el10_1
  • 6.12.0-124.8.1.el10_1
  • 6.12.0-124.11.1.el10_1
  • 6.12.0-124.13.1.el10_1
  • 6.12.0-124.16.1.el10_1
  • 6.12.0-124.20.1.el10_1
  • 6.12.0-124.21.1.el10_1
  • 6.12.0-124.27.1.el10_1
  • 6.12.0-124.28.1.el10_1
  • 6.12.0-124.29.1.el10_1
  • 6.12.0-124.31.1.el10_1
  • 6.12.0-124.35.1.el10_1
  • 6.12.0-124.38.1.el10_1
  • 6.12.0-124.39.1.el10_1
  • 6.12.0-124.43.1.el10_1
  • 6.12.0-124.45.1.el10_1
  • 6.12.0-124.47.1.el10_1
  • 6.12.0-124.49.1.el10_1
  • 6.12.0-124.52.1.el10_1
  • 6.12.0-124.55.1.el10_1
  • 6.12.0-124.56.1.el10_1
  • 6.12.0-211.16.1.el10_2
  • 6.12.0-211.7.1.el10_2
  • 6.12.0-211.7.3.el10_2
  • 6.12.0-124.40.1.el10_1
  • 6.12.0-211.18.1.el10_2
  • 6.12.0-211.20.1.el10_2
  • 6.12.0-211.22.1.el10_2
  • 6.12.0-211.26.1.el10_2
  • 6.12.0-211.28.1.el10_2
  • 6.12.0-211.29.1.el10_2
  • 6.12.0-211.30.1.el10_2
  • 6.12.0-211.31.1.el10_2
  • 6.12.0-211.32.1.el10_2
  • 6.12.0-211.33.1.el10_2
  • 6.12.0-211.34.1.el10_2
RHEL 8 In Progress —
Rocky Linux 10 Released
35 kernels
  • 6.12.0-55.27.1.el10_0
  • 6.12.0-55.29.1.el10_0
  • 6.12.0-55.30.1.el10_0
  • 6.12.0-55.32.1.el10_0
  • 6.12.0-55.34.1.el10_0
  • 6.12.0-55.37.1.el10_0
  • 6.12.0-55.39.1.el10_0
  • 6.12.0-55.40.1.el10_0
  • 6.12.0-55.41.1.el10_0
  • 6.12.0-124.8.1.el10_1
  • 6.12.0-124.13.1.el10_1
  • 6.12.0-124.16.1.el10_1
  • 6.12.0-124.20.1.el10_1
  • 6.12.0-124.21.1.el10_1
  • 6.12.0-124.27.1.el10_1
  • 6.12.0-124.28.1.el10_1
  • 6.12.0-124.29.1.el10_1
  • 6.12.0-124.31.1.el10_1
  • 6.12.0-124.35.1.el10_1
  • 6.12.0-124.38.1.el10_1
  • 6.12.0-124.45.1.el10_1
  • 6.12.0-124.47.1.el10_1
  • 6.12.0-124.49.1.el10_1
  • 6.12.0-124.52.1.el10_1
  • 6.12.0-124.55.1.el10_1
  • 6.12.0-124.56.1.el10_1
  • 6.12.0-124.40.1.el10_1
  • 6.12.0-211.18.1.el10_2
  • 6.12.0-211.22.1.el10_2
  • 6.12.0-211.26.1.el10_2
  • 6.12.0-211.28.1.el10_2
  • 6.12.0-211.32.1.el10_2
  • 6.12.0-211.16.1.el10_2.0.1
  • 6.12.0-211.33.1.el10_2
  • 6.12.0-211.34.1.el10_2