CVE-2026-53009

Description

In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time. The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path. The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch. I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN. I looked for similar bugs in related Intel drivers and did not find any.

CVSS Metrics

• v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.14%• Percentile: 4%

Techniques & Countermeasures

• CWE-1341•Multiple Releases of Same Resource or Handle

  The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.

• CWE-415•Double Free

  The product calls free() twice on the same memory address.

• CWE-416•Use After Free

  The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected Systems

• chainguard•hyperv-daemons-6.18

  all

• chainguard•linux-aws-6.12

  all

• chainguard•linux-aws-6.18

  all

• chainguard•linux-aws-6.18-boot-installed

  all

• chainguard•linux-aws-6.18-bootc

  all

• chainguard•linux-aws-6.18-bootc-boot-installed

  all

• chainguard•linux-aws-6.18-fips-boot-installed

  all

• chainguard•linux-aws-6.18-headers

  all

• chainguard•linux-aws-6.18-modules

  all

• chainguard•linux-azure-6.12

  all

• chainguard•linux-azure-6.18

  all

• chainguard•linux-azure-6.18-boot-installed

  all

• chainguard•linux-azure-6.18-fips-boot-installed

  all

• chainguard•linux-azure-6.18-headers

  all

• chainguard•linux-azure-6.18-modules

  all

• chainguard•linux-desktop-6.18

  all

• chainguard•linux-desktop-6.18-bootc

  all

• chainguard•linux-desktop-6.18-bootc-boot-installed

  all

• chainguard•linux-desktop-6.18-headers

  all

• chainguard•linux-desktop-6.18-modules

  all

• chainguard•linux-firecracker-6.18

  all

• chainguard•linux-gcp-6.12

  all

• chainguard•linux-gcp-6.18

  < 0

• chainguard•linux-gcp-6.18-bootc

  < 0

• chainguard•linux-gcp-6.18-bootc-boot-installed

  < 6.18.38-r2

• chainguard•linux-qemu-6.12

  all

• chainguard•linux-qemu-6.18

  < 6.18.44-r1 | < 0

• chainguard•linux-qemu-6.18-bootc

  < 6.18.44-r1 | < 0

• chainguard•linux-qemu-6.18-bootc-boot-installed

  < 6.18.38-r2

• chainguard•linux-qemu-melange

  all

• chainguard•linux-vmware-6.12

  all

• chainguard•linux-vmware-6.18

  all

• chainguard•linux-vmware-6.18-boot-installed

  all

• chainguard•linux-vmware-6.18-fips-boot-installed

  all

• chainguard•linux-vmware-6.18-headers

  all

• chainguard•linux-vmware-6.18-modules

  all

• debian•linux

  all | all | all | < 7.0.10-1

• ubuntu•linux

  all | all | all | all | < 7.0.0-28.28

• ubuntu•linux-allwinner-5.19

  all

• ubuntu•linux-aws

  all | all | all | all | < 7.0.0-1009.9

• ubuntu•linux-aws-5.0

  all

• ubuntu•linux-aws-5.11

  all

• ubuntu•linux-aws-5.13

  all

• ubuntu•linux-aws-5.15

  all

• ubuntu•linux-aws-5.19

  all

• ubuntu•linux-aws-5.3

  all

• ubuntu•linux-aws-5.4

  all

• ubuntu•linux-aws-5.8

  all

• ubuntu•linux-aws-6.14

  all

• ubuntu•linux-aws-6.17

  all

Showing first 50 affected entries in server-rendered view.

References (26)

• https://git.kernel.org/stable/c/4c08fc2119ef0281cfa2cee007acf0a251be55f2
• https://git.kernel.org/stable/c/1a303baa715e6b78d6a406aaf335f87ff35acfcd
• https://access.redhat.com/security/cve/CVE-2026-53009
• https://bugzilla.redhat.com/show_bug.cgi?id=2492390
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53009.json
• https://access.redhat.com/errata/RHSA-2026:42919
• https://access.redhat.com/errata/RHSA-2026:54246
• https://access.redhat.com/errata/RHSA-2026:54247
• https://ubuntu.com/security/CVE-2026-53009
• https://www.cve.org/CVERecord?id=CVE-2026-53009
• https://git.kernel.org/linus/1a303baa715e6b78d6a406aaf335f87ff35acfcd
• https://ubuntu.com/security/notices/USN-8566-1
• https://ubuntu.com/security/notices/USN-8568-1
• https://ubuntu.com/security/notices/USN-8569-1
• https://ubuntu.com/security/notices/USN-8593-1
• https://ubuntu.com/security/notices/USN-8603-1
• https://ubuntu.com/security/notices/USN-8618-1
• https://security-tracker.debian.org/tracker/CVE-2026-53009
• https://ubuntu.com/security/notices/USN-8663-1
• https://ubuntu.com/security/notices/USN-8664-1
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53009.json
• https://nvd.nist.gov/vuln/detail/CVE-2026-53009
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
• https://ubuntu.com/security/notices/USN-8728-1
• https://access.redhat.com/errata/RHSA-2026:65712
• https://access.redhat.com/errata/RHSA-2026:65711