PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46162 Linux CVE debrief

A double-free vulnerability exists in the Linux kernel's Intel Ethernet Connection (ice) driver, specifically within the `ice_sf_eth_activate()` function. The flaw occurs in the error handling path when `auxiliary_device_add()` fails. The function calls `auxiliary_device_uninit()`, which triggers `ice_sf_dev_release()` to free the `sf_dev` structure. However, the error path continues to `sf_dev_free` and calls `kfree(sf_dev)` again, resulting in a double-free condition. This vulnerability could lead to memory corruption, system instability, or potential privilege escalation. The issue affects kernel versions where the ice driver's subfunction (SF) Ethernet activation logic is present. Patches have been committed to stable kernel branches to fix the error path flow, ensuring that `kfree(sf_dev)` is only called for `auxiliary_device_init()` failures and not after `auxiliary_device_uninit()` has already released the device.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Organizations running Linux systems with Intel E810 series Ethernet controllers using subfunction (SF) features; cloud providers and data centers utilizing SR-IOV or similar virtualization features on Intel NICs; kernel maintainers and distribution security teams responsible for ice driver packaging.

Technical summary

The vulnerability is a classic double-free bug in error handling code. In `ice_sf_eth_activate()`, when `auxiliary_device_add()` fails, the function jumps to `aux_dev_uninit` label and calls `auxiliary_device_uninit(&sf_dev->adev)`. This uninit call triggers the release callback `ice_sf_dev_release()`, which frees `sf_dev`. The problematic code then falls through to `sf_dev_free` label and calls `kfree(sf_dev)` again. The fix separates the cleanup paths: `kfree(sf_dev)` is retained only for the `auxiliary_device_init()` failure path, while the `auxiliary_device_add()` failure path avoids the second free by not falling through to `sf_dev_free`.

Defensive priority

high

Recommended defensive actions

  • Apply kernel patches from stable branches (6.1, 6.6, 6.12, 6.14) once available through distribution security updates
  • Monitor distribution security advisories for ice driver package updates
  • If running affected kernel versions with Intel E810 series NICs using subfunctions, prioritize patching due to potential for memory corruption
  • Review system logs for any ice driver-related errors that may indicate trigger conditions
  • Consider disabling unused subfunction features if not required as a temporary risk reduction measure

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Technical details derived from kernel commit messages describing the double-free condition in `ice_sf_eth_activate()`. Multiple stable kernel branch commits identified (6.1, 6.6, 6.12, 6.14). No CVSS score or severity assigned by NVD at time of disclosure (status: Awaiting Analysis).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46162 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46162

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46162 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46162

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/121d1f253aed515cd85748f68c664a6cb756e8ad

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2ca30340b5028ddc3f17086a538feeff06167b1b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9aab1c3d7299285e2569cbc0ed5892d631a241b2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d0c6a4816609f145ffcc74e64baa214c571c17c6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.