CVE-2026-72425 Linux CVE debrief

Who should care

Linux kernel users and administrators who use the ice driver, especially those with FDIR filters enabled on VFs, should be aware of this vulnerability and take steps to apply the patch and prevent potential exploitation. This includes verifying ice driver versions, reviewing configurations, and monitoring for potential exploitation attempts.

Technical summary

The Linux kernel ice driver has a vulnerability that causes a resource leak in the ice_reset_all_vfs() function when FDIR filters are enabled on VFs. The issue arises because CTRL VSIs are only invalidated and not freed during the reset process. To fix this, the ice_vf_ctrl_vsi_release() function should be used instead of ice_vf_ctrl_invalidate_vsi() to align the behavior with the ice_reset_vf() function. This vulnerability can be addressed by updating the ice driver with the patch provided.

Defensive priority

Medium

Recommended defensive actions

• Inventory and assess Linux kernel versions in use to identify potential exposure.
• Apply the patch to update the ice driver and prevent resource leaks.
• Monitor for potential exploitation attempts and update threat intelligence accordingly.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The Linux kernel ice driver has a vulnerability that causes a resource leak in the ice_reset_all_vfs() function when FDIR filters are enabled on VFs. The issue arises because CTRL VSIs are only invalidated and not freed during the reset process. To fix this, the ice_vf_ctrl_vsi_release() function should be used instead of ice_vf_ctrl_invalidate_vsi() to align the behavior with the ice_reset_vf() function. Linux kernel users should verify their ice driver versions and configurations to identify potential exposure. The vulnerability is related to a resource leak in the ice_reset_all_vfs() function when FDIR filters are enabled on VFs.

Official resources