Linux kernel ice driver: double free of transmit skb on the TSO/checksum error path

Impact

When ice_tso() or ice_tx_csum() fails, ice_xmit_frame_ring() frees the skb but leaves the tx_buf still marked ICE_TX_BUF_SKB, so bringing the interface down afterwards makes ice_clean_tx_ring() free the same skb a second time. Intel E810 NICs are common as the host/management and storage NIC on GPU nodes alongside the RDMA fabric adapters, so this sits in a driver that is loaded on production nodes. The practical trigger is narrow - the reporter needed injected failures under KASAN, and a following transmit normally overwrites the stale tx_buf - but a double free in the kernel allocator is a local memory-corruption primitive and interface-down is a routine operation during drain. There is no remote or fabric-side path here.

Who can reach it

Local, and in practice requires the ability to make the transmit offload path fail and then bring the interface down; the record describes reproduction only with injected failures. No remote attacker path.

What to do

Take the stable kernel fix (referenced commits) or the Red Hat errata kernels RHSA-2026:42919 / 54246 / 54247, then reboot each node running the ice driver. Nodes can be patched during the normal drain-and-reboot rotation; nothing in the record suggests urgency ahead of that.

References

Related entries

• Linux kernel ccp driver: IV restore overruns the 8-byte RFC3686 IV bufferCVE-2026-53016 · Linux kernel crypto/ccp (AMD Cryptographic Coprocessor, RFC3686 CTR-AES)High
• Linux kernel BPF arena: unvalidated NUMA node_id passed down the page allocation chainCVE-2026-53031 · Linux kernel BPF arena (arena_alloc_pages node_id validation)High
• Linux kernel BPF sockmap: use-after-free on the af_unix peer when a socket closes during iterationCVE-2026-53033 · Linux kernel BPF sockmap (unix_stream_bpf_update_proto, af_unix iterator)High
• Linux kernel BPF: sock_ops same-register context access leaks a kernel pointer and reads out of boundsCVE-2026-53078 · Linux kernel BPF sock_ops context access (SOCK_OPS_GET_SK / SOCK_OPS_GET_FIELD)High
• Linux kernel BPF verifier: inconsistent ADD_CONST base ids let unsafe state pruning succeedCVE-2026-53081 · Linux kernel BPF verifier (regsafe base-id consistency for BPF_ADD_CONST scalars)High
• Linux kernel BPF task_vma iterator: mm_struct used without a reference, freed under the iteratorCVE-2026-53085 · Linux kernel BPF (open-coded task_vma iterator, mm_struct lifecycle)High