https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 21:47:18 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-99043 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ice: fix metadata_dst refcount handling on representor teardown</p> <p>ice_eswitch_release_repr() uses metadata_dst_free() to release the representor&#39;s metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry refcount.</p> <p>When ice_eswitch_port_start_xmit() processes a packet, it takes a reference via dst_hold() and attaches the metadata_dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata_dst is freed while references are still held.</p> <p>Use dst_release() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.</p> <p>Other drivers sharing this pattern (nfp, airoha, bnxt) already use dst_release() for their metadata_dst lifecycle.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ice: fix metadata_dst refcount handling on representor teardown</p> <p>ice_eswitch_release_repr() uses metadata_dst_free() to release the representor&#39;s metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry refcount.</p> <p>When ice_eswitch_port_start_xmit() processes a packet, it takes a reference via dst_hold() and attaches the metadata_dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata_dst is freed while references are still held.</p> <p>Use dst_release() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.</p> <p>Other drivers sharing this pattern (nfp, airoha, bnxt) already use dst_release() for their metadata_dst lifecycle.</p> https://db.gcve.eu/vuln/fkie_cve-2026-99043 https://db.gcve.eu/vuln/ghsa-45qx-wx52-595w <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ice: fix metadata_dst refcount handling on representor teardown</p> <p>ice_eswitch_release_repr() uses metadata_dst_free() to release the representor&#39;s metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry refcount.</p> <p>When ice_eswitch_port_start_xmit() processes a packet, it takes a reference via dst_hold() and attaches the metadata_dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata_dst is freed while references are still held.</p> <p>Use dst_release() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.</p> <p>Other drivers sharing this pattern (nfp, airoha, bnxt) already use dst_release() for their metadata_dst lifecycle.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ice: fix metadata_dst refcount handling on representor teardown</p> <p>ice_eswitch_release_repr() uses metadata_dst_free() to release the representor&#39;s metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry refcount.</p> <p>When ice_eswitch_port_start_xmit() processes a packet, it takes a reference via dst_hold() and attaches the metadata_dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata_dst is freed while references are still held.</p> <p>Use dst_release() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.</p> <p>Other drivers sharing this pattern (nfp, airoha, bnxt) already use dst_release() for their metadata_dst lifecycle.</p> https://db.gcve.eu/vuln/ghsa-45qx-wx52-595w https://db.gcve.eu/vuln/msrc_cve-2026-99043 msrc_CVE-2026-99043 https://db.gcve.eu/vuln/msrc_cve-2026-99043