CVE-2026-23104: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23104 Overview

A use-after-free vulnerability has been identified in the Linux kernel's ice network driver related to the devlink reload functionality. The vulnerability occurs due to improper cleanup of HWMON (Hardware Monitoring) instances during driver reload operations, resulting in dangling pointers that can cause kernel page faults when system monitoring tools attempt to access orphaned sysfs attributes.

Critical Impact

System monitoring tools accessing orphaned hwmon sysfs attributes can trigger kernel page faults approximately every 10 minutes, potentially leading to system instability and denial of service conditions on affected Linux systems using Intel ice network drivers.

Affected Products

• Linux kernel with ice network driver (versions with commit 4da71a77fc3b)
• Systems using Intel Ethernet devices managed by the ice driver
• Linux systems utilizing devlink reload functionality with HWMON temperature monitoring

Discovery Timeline

• February 4, 2026 - CVE-2026-23104 published to NVD
• February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23104

Vulnerability Analysis

The vulnerability stems from an asymmetric initialization and cleanup pattern introduced when internal temperature sensor reading via HWMON was added to the ice driver. The ice_hwmon_init() function is called from ice_init_feature() during driver initialization, but its counterpart ice_hwmon_exit() was placed in ice_remove() rather than in a corresponding deinitialization function.

This architectural flaw creates a problematic sequence during devlink reload operations. When the driver is loaded, ice_hwmon_init() creates the first HWMON instance. During a devlink reload down operation, the cleanup flow does not call ice_remove(), leaving the first HWMON instance intact. When devlink reload up executes, ice_hwmon_init() is called again from ice_init_feature(), creating a second HWMON instance. Upon driver unload, ice_hwmon_exit() in ice_remove() only cleans up the most recent instance, leaving the original HWMON instance orphaned with a dangling pointer to freed module memory.

Root Cause

The root cause is the placement of ice_hwmon_exit() in ice_remove() rather than in ice_deinit_features(). This creates an initialization/deinitialization asymmetry where ice_hwmon_init() is called from ice_init_feature() but cleanup occurs in a different code path. The lack of proper cleanup symmetry means that devlink reload operations can create multiple HWMON instances, but only the last one gets properly destroyed during driver removal.

Attack Vector

The vulnerability is triggered through the following sequence:

1. Driver Load: ice_hwmon_init() is called from ice_init_feature(), creating the first HWMON instance with sysfs attributes
2. Devlink Reload Down: The driver reinitializes but does not call ice_remove(), leaving the first HWMON instance active
3. Devlink Reload Up: ice_hwmon_init() is called again, creating a second HWMON instance
4. Driver Unload: ice_hwmon_exit() is called from ice_remove(), cleaning up only the second instance
5. Post-Unload Access: System monitoring daemons (such as sadc) continue to poll the orphaned sysfs attributes, triggering page faults when accessing freed module memory

The kernel call trace shows the fault occurring in the name_show function when attempting to read device attributes that reference deallocated memory addresses (e.g., ffffffffc0fd4b5d).

Detection Methods for CVE-2026-23104

Indicators of Compromise

• Kernel page fault errors with addresses in the kernel module memory range (typically starting with ffffffffc0)
• Call traces showing name_show, dev_attr_show, sprintf, or string functions in the stack
• Recurring kernel errors approximately every 10 minutes corresponding to system monitoring polling intervals
• Multiple HWMON instances registered for a single ice network device in /sys/class/hwmon/

Detection Strategies

• Monitor kernel logs (dmesg, /var/log/kern.log) for "unable to handle page fault" errors referencing ice driver memory regions
• Audit systems that use devlink reload commands on ice network interfaces
• Check for multiple hwmon entries associated with single ice network devices after reload operations
• Implement kernel tracing on ice_hwmon_init() and ice_hwmon_exit() functions to detect asymmetric calls

Monitoring Recommendations

• Configure alerting on kernel panic or page fault messages in centralized logging systems
• Monitor for unexpected ice driver reload events using auditd or similar system auditing tools
• Track HWMON device registration and deregistration events on systems with Intel ice network adapters
• Implement health checks for sysfs attribute accessibility on ice driver HWMON interfaces

How to Mitigate CVE-2026-23104

Immediate Actions Required

• Apply the kernel patch that moves ice_hwmon_exit() from ice_remove() to ice_deinit_features() for proper cleanup symmetry
• Avoid using devlink reload operations on systems with vulnerable ice driver versions until patched
• Restart affected systems after driver unload to clear orphaned HWMON instances
• Temporarily disable HWMON temperature monitoring for ice devices if devlink reload is required

Patch Information

The fix involves moving the ice_hwmon_exit() call from ice_remove() to ice_deinit_features(), ensuring proper cleanup symmetry with ice_hwmon_init(). This change guarantees that HWMON instances are properly destroyed during devlink reload operations, preventing orphaned sysfs attributes.

Patches are available in the following kernel commits:

• Kernel Commit 87c1dacca197cc64e06fedeb269e3dd6699bae60
• Kernel Commit d3f867e7a04678640ebcbfb81893c59f4af48586

Workarounds

• Avoid using devlink dev reload commands on ice network devices until the kernel is patched
• If devlink reload is necessary, fully unload and reload the ice module instead of using devlink reload
• Temporarily disable system monitoring tools that poll HWMON sysfs attributes after devlink reload operations
• Consider using out-of-band temperature monitoring solutions as an alternative to HWMON until patched

# Workaround: Full module reload instead of devlink reload
# Remove the ice module completely
modprobe -r ice

# Reload the ice module
modprobe ice

# Verify single HWMON instance
ls -la /sys/class/hwmon/ | grep ice