CVE-2026-53009

A flaw was found in the Linux kernel's ice network driver. An error in the driver's handling of network packet transmission, specifically when ice_tso() or ice_tx_csum() functions fail, can lead to a double-free of a network buffer (skb). This occurs because a transmit buffer (tx_buf) may still point to an already freed buffer. If the network interface is subsequently brought down, this double-free can be triggered, potentially leading to a system crash or denial of service (DoS).

A double free can occur in the Intel ice TX path when ice_xmit_frame_ring() stores an skb in the first tx_buf and marks it as ICE_TX_BUF_SKB, then an ice_tso() or ice_tx_csum() failure drops and frees the skb while the tx_buf still points to it. If no later packet overwrites that descriptor before the interface or TX ring is cleaned, ice_clean_tx_ring() can free the same skb again. For the CVSS the PR:L because a local user or process that can transmit traffic through an affected ice interface may reach the TX path, although reliable triggering also depends on forcing an offload error and a later cleanup window.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module ice from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.