CVE-2026-23104: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23104 Overview

A use-after-free vulnerability has been identified in the Linux kernel's ice network driver related to the devlink reload functionality. The vulnerability occurs due to improper cleanup of HWMON (Hardware Monitoring) instances during driver reload operations, resulting in dangling pointers that can cause kernel page faults when system monitoring tools attempt to access orphaned sysfs attributes.

Critical Impact
System monitoring tools accessing orphaned hwmon sysfs attributes can trigger kernel page faults approximately every 10 minutes, potentially leading to system instability and denial of service conditions on affected Linux systems using Intel ice network drivers.

Affected Products

Linux kernel with ice network driver (versions with commit 4da71a77fc3b)
Systems using Intel Ethernet devices managed by the ice driver
Linux systems utilizing devlink reload functionality with HWMON temperature monitoring

Discovery Timeline

February 4, 2026 - CVE-2026-23104 published to NVD
February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23104

Vulnerability Analysis

The vulnerability stems from an asymmetric initialization and cleanup pattern introduced when internal temperature sensor reading via HWMON was added to the ice driver. The ice_hwmon_init() function is called from ice_init_feature() during driver initialization, but its counterpart ice_hwmon_exit() was placed in ice_remove() rather than in a corresponding deinitialization function.

This architectural flaw creates a problematic sequence during devlink reload operations. When the driver is loaded, ice_hwmon_init() creates the first HWMON instance. During a devlink reload down operation, the cleanup flow does not call ice_remove(), leaving the first HWMON instance intact. When devlink reload up executes, ice_hwmon_init() is called again from ice_init_feature(), creating a second HWMON instance. Upon driver unload, ice_hwmon_exit() in ice_remove() only cleans up the most recent instance, leaving the original HWMON instance orphaned with a dangling pointer to freed module memory.

Root Cause

The root cause is the placement of ice_hwmon_exit() in ice_remove() rather than in ice_deinit_features(). This creates an initialization/deinitialization asymmetry where ice_hwmon_init() is called from ice_init_feature() but cleanup occurs in a different code path. The lack of proper cleanup symmetry means that devlink reload operations can create multiple HWMON instances, but only the last one gets properly destroyed during driver removal.

Attack Vector

The vulnerability is triggered through the following sequence:

Driver Load: ice_hwmon_init() is called from ice_init_feature(), creating the first HWMON instance with sysfs attributes
Devlink Reload Down: The driver reinitializes but does not call ice_remove(), leaving the first HWMON instance active
Devlink Reload Up: ice_hwmon_init() is called again, creating a second HWMON instance
Driver Unload: ice_hwmon_exit() is called from ice_remove(), cleaning up only the second instance
Post-Unload Access: System monitoring daemons (such as sadc) continue to poll the orphaned sysfs attributes, triggering page faults when accessing freed module memory

The kernel call trace shows the fault occurring in the name_show function when attempting to read device attributes that reference deallocated memory addresses (e.g., ffffffffc0fd4b5d).

Detection Methods for CVE-2026-23104

Indicators of Compromise

Kernel page fault errors with addresses in the kernel module memory range (typically starting with ffffffffc0)
Call traces showing name_show, dev_attr_show, sprintf, or string functions in the stack
Recurring kernel errors approximately every 10 minutes corresponding to system monitoring polling intervals
Multiple HWMON instances registered for a single ice network device in /sys/class/hwmon/

Detection Strategies

Monitor kernel logs (dmesg, /var/log/kern.log) for "unable to handle page fault" errors referencing ice driver memory regions
Audit systems that use devlink reload commands on ice network interfaces
Check for multiple hwmon entries associated with single ice network devices after reload operations
Implement kernel tracing on ice_hwmon_init() and ice_hwmon_exit() functions to detect asymmetric calls

Monitoring Recommendations

Configure alerting on kernel panic or page fault messages in centralized logging systems
Monitor for unexpected ice driver reload events using auditd or similar system auditing tools
Track HWMON device registration and deregistration events on systems with Intel ice network adapters
Implement health checks for sysfs attribute accessibility on ice driver HWMON interfaces

How to Mitigate CVE-2026-23104

Immediate Actions Required

Apply the kernel patch that moves ice_hwmon_exit() from ice_remove() to ice_deinit_features() for proper cleanup symmetry
Avoid using devlink reload operations on systems with vulnerable ice driver versions until patched
Restart affected systems after driver unload to clear orphaned HWMON instances
Temporarily disable HWMON temperature monitoring for ice devices if devlink reload is required

Patch Information

The fix involves moving the ice_hwmon_exit() call from ice_remove() to ice_deinit_features(), ensuring proper cleanup symmetry with ice_hwmon_init(). This change guarantees that HWMON instances are properly destroyed during devlink reload operations, preventing orphaned sysfs attributes.

Patches are available in the following kernel commits:

Workarounds

Avoid using devlink dev reload commands on ice network devices until the kernel is patched
If devlink reload is necessary, fully unload and reload the ice module instead of using devlink reload
Temporarily disable system monitoring tools that poll HWMON sysfs attributes after devlink reload operations
Consider using out-of-band temperature monitoring solutions as an alternative to HWMON until patched

bash

# Workaround: Full module reload instead of devlink reload
# Remove the ice module completely
modprobe -r ice

# Reload the ice module
modprobe ice

# Verify single HWMON instance
ls -la /sys/class/hwmon/ | grep ice