Linux kernel ice driver: double free of transmit skb on the TSO/checksum error path

Impact

When ice_tso() or ice_tx_csum() fails, ice_xmit_frame_ring() frees the skb but leaves the tx_buf still marked ICE_TX_BUF_SKB, so bringing the interface down afterwards makes ice_clean_tx_ring() free the same skb a second time. Intel E810 NICs are common as the host/management and storage NIC on GPU nodes alongside the RDMA fabric adapters, so this sits in a driver that is loaded on production nodes. The practical trigger is narrow - the reporter needed injected failures under KASAN, and a following transmit normally overwrites the stale tx_buf - but a double free in the kernel allocator is a local memory-corruption primitive and interface-down is a routine operation during drain. There is no remote or fabric-side path here.

Who can reach it

Local, and in practice requires the ability to make the transmit offload path fail and then bring the interface down; the record describes reproduction only with injected failures. No remote attacker path.

What to do

Take the stable kernel fix (referenced commits) or the Red Hat errata kernels RHSA-2026:42919 / 54246 / 54247, then reboot each node running the ice driver. Nodes can be patched during the normal drain-and-reboot rotation; nothing in the record suggests urgency ahead of that.

References

Related entries

• Linux kernel ccp driver: IV restore overruns the 8-byte RFC3686 IV bufferCVE-2026-53016 · Linux kernel crypto/ccp (AMD Cryptographic Coprocessor, RFC3686 CTR-AES)High
• Linux BPF offload: refcount increment on a dying netns causes use-after-free during info queryCVE-2026-53089 · Linux kernel BPF offload (bpf_map/prog_offload_info_fill_ns netns refcount)High
• Linux kernel BPF verifier: ld_abs/ld_ind failure path left unverified inside subprogramsCVE-2026-53090 · Linux kernel BPF verifier (ld_abs/ld_ind in subprograms)High
• Linux kernel BPF verifier: mis-tracked rX += rX delta lets a program diverge from its verified boundsCVE-2026-53092 · Linux kernel BPF verifier (linked-register delta tracking in adjust_reg_min_max_vals())High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-53143 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel list_lru: cgroup teardown race lets two CPUs unlink the same list item under different locksCVE-2026-53153 · Linux kernel mm/list_lru (memcg reparenting on cgroup teardown)High