CVE-2026-97979 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that use the ice driver should be aware of this vulnerability. They should verify that their Linux kernel version has the fix applied and monitor system memory usage to detect potential memory leaks. Additionally, security teams and operators managing Linux-based systems should review the vulnerability and implement compensating controls to mitigate

Why it matters

A memory leak vulnerability was found in the Linux kernel's ice driver. The vulnerability arises from a missing call to xa_destroy for the sched_node_ids xarray, which can cause system memory exhaustion and potential denial-of-service (DoS). Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that use the ice driver should verify that their Linux kernel version has the fix applied and monitor system memory usage.

• Memory leak vulnerability can cause system memory exhaustion.
• Potential denial-of-service (DoS) due to memory exhaustion.
• Requires verification of Linux kernel version and patch application.

Technical summary

The Linux kernel ice driver has a memory leak vulnerability due to a missing call to xa_destroy for the sched_node_ids xarray. The xarray is used to store scheduler node IDs and is embedded in the port_info structure. To address this issue, the sched_node_ids was moved out of port_info and into the hw structure, and a call to xa_destroy was added to the cleanup path and to ice_deinit_hw(). The fix involves modifying the ice driver to properly release xarray memory, preventing potential memory leaks and denial-of-service (DoS) attacks.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the Linux kernel patch to ensure the ice driver properly releases xarray memory.
• Verify that the Linux kernel version used in your system has the fix applied.
• Monitor system memory usage to detect potential memory leaks.
• Perform a thorough review of the system for potential memory leaks and denial-of-service (DoS) attacks.
• Implement compensating controls to mitigate potential memory exhaustion and DoS attacks.
• Track exceptions and retest remediated assets to ensure the vulnerability is properly addressed.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and references to the Linux kernel source code changes that address the issue. The vulnerability was found in the Linux kernel's ice driver due to a missing call to xa_destroy for the sched_node_ids xarray. This xarray is used to store scheduler node IDs and is embedded in the port_info structure. The vulnerability arises because the port_info structure is allocated using devm and not released until the devm cleanup when the driver is un

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.