CVE-2026-99044 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
ice: fix use-after-free in dynamic port cleanup
ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic port from pf->dyn_ports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-free.
Follow the reverse of the allocation order in ice_alloc_dynamic_port() by erasing the xarray entry before freeing the VSI.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel driver for Intel Ethernet controllers contains a critical memory management flaw within its dynamic port cleanup routine that leads to a use-after-free vulnerability. This issue resides specifically in the ice_dealloc_dynamic_port function, which is responsible for releasing resources associated with dynamically allocated network ports. The root cause of this defect lies in the incorrect sequencing of operations during resource deallocation. Specifically, the code attempts to access the virtual station interface index via dyn_port->vsi->idx to locate and remove the dynamic port entry from the parent functions xarray structure pf->dyn_ports after the VSI object has already been freed. This sequence violates fundamental memory safety principles by dereferencing a pointer to an object that no longer exists in valid memory, creating a window where stale pointers are accessed for administrative cleanup tasks.
From a technical perspective, this vulnerability represents a classic use-after-free condition resulting from improper resource ordering during teardown operations. The allocation logic in ice_alloc_dynamic_port establishes the correct order of operations by initializing and linking resources before finalizing their association with higher-level structures. However, the deallocation path failed to mirror this reverse dependency chain correctly. By freeing the VSI structure prior to extracting its index for removal from the parent container, the driver introduces undefined behavior into the kernel space. Depending on memory allocation patterns and timing, accessing the freed VSI pointer may result in reading corrupted data, triggering a kernel panic due to invalid memory access, or potentially allowing an attacker with local privileges to exploit the stale reference to execute arbitrary code within the kernel context.
The operational impact of this vulnerability is significant for systems relying on Intel Ethernet adapters managed by the ice driver. Local attackers who possess sufficient privileges to trigger network interface reconfiguration or port teardown operations can induce a denial of service by causing system crashes through kernel oopses or panics. In more sophisticated attack scenarios, if an attacker can control the memory contents that overwrite the freed VSI structure before it is accessed again, they might achieve arbitrary code execution with kernel-level privileges. This effectively bypasses standard user-space isolation mechanisms and grants full control over the underlying operating system, compromising confidentiality, integrity, and availability of all data processed by the host machine.
This flaw aligns with CWE-416, which describes use-after-free vulnerabilities where a pointer is used after it has been freed, leading to unpredictable behavior. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates privilege escalation techniques often categorized under Local Privilege Escalation or Kernel Exploitation vectors like Taint Analysis and Memory Corruption. Mitigation strategies primarily involve applying the upstream kernel patch that corrects the deallocation sequence by ensuring the xarray entry is erased before the VSI memory is released. System administrators should prioritize updating to a patched version of the Linux kernel that includes this fix for the ice driver. Additionally, enforcing strict least-privilege policies and monitoring for unusual system crashes or kernel logs related to network interface management can help detect potential exploitation attempts in environments where immediate patching may not be feasible.