Linux kernel ice: double free in the E810 subfunction activation error path

Impact

When auxiliary_device_add() fails during activation of an ice subfunction, the error path calls auxiliary_device_uninit() - whose release callback already frees sf_dev - and then falls through to kfree(sf_dev), freeing it a second time. The ice driver runs the Intel E810 NICs used for host and storage networking on many GPU nodes, and subfunctions are how those ports are carved up for containers and VMs. Reaching the bug needs the activation to fail partway, so in practice this is a crash or slab corruption during a privileged devlink operation rather than a tenant-reachable escalation. On a GPU node the cost is the outage: a corrupted slab means the node goes down and has to be drained and rebooted.

Who can reach it

Local and privileged. Requires the ability to create and activate ice subfunctions over devlink (root / CAP_NET_ADMIN on the host), plus a failing auxiliary_device_add(). No tenant or network path.

What to do

Take the stable kernel that keeps kfree(sf_dev) only on the auxiliary_device_init() failure path. Kernel update means drain each affected node and reboot it; schedule with the normal kernel cadence rather than out of band. Until then, avoid repeated subfunction create/activate churn on nodes still running the old kernel.

References

Related entries

• Linux kernel (drivers/net/ethernet/mellanox/mlx4): Shared receive queue objects are looked up from an asynchronousCVE-2026-46181 · Linux kernel (drivers/net/ethernet/mellanox/mlx4)High
• Linux kernel vmw_pvrdma: double free on ucontext allocation error pathCVE-2026-46189 · Linux kernel vmw_pvrdma driver (pvrdma_alloc_ucontext error path)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-46197 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel skbuff: coalescing drops SKBFL_SHARED_FRAG, letting ESP decrypt in place over shared pagesCVE-2026-46300 · Linux kernel net/core skbuff (skb_try_coalesce shared-frag marker)High
• Glances: KVM domain names are interpolated into shell commands, giving root on the hypervisor hostCVE-2026-46606 · Glances monitoring agent (KVM/QEMU vms plugin, virsh.py domain name interpolation)High
• virtio-win Viosock: integer overflow in the select IOCTL overflows a NonPagedPool array and escalates in the guestCVE-2026-46655 · virtio-win Viosock driver (IOCTL_SELECT, VIOSockSelect bounds check)High