CVE-2026-46162: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46162 Overview

CVE-2026-46162 is a double free vulnerability in the Linux kernel's Intel Ethernet (ice) driver. The flaw resides in the ice_sf_eth_activate() function's error handling path. When auxiliary_device_add() fails, the function jumps to the aux_dev_uninit label and invokes auxiliary_device_uninit(&sf_dev->adev). The device release callback ice_sf_dev_release() then frees sf_dev. The error path falls through to the sf_dev_free label and calls kfree(sf_dev) a second time on the already-released memory. Linux kernel maintainers have resolved the issue across stable branches.

Critical Impact
A double free in kernel memory can corrupt the slab allocator state, leading to kernel panics, denial of service, or potential memory corruption that could be leveraged for further exploitation.

Affected Products

Linux kernel versions containing the ice driver subflow (SF) auxiliary device support
Systems using Intel Ethernet adapters managed by the ice driver
Distributions tracking mainline or stable kernel branches prior to the fix commits

Discovery Timeline

2026-05-28 - CVE-2026-46162 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46162

Vulnerability Analysis

The vulnerability is a double free [CWE-415] in the Intel ice network driver's subfunction (SF) Ethernet activation routine. The ice_sf_eth_activate() function allocates an auxiliary device structure (sf_dev) and initializes it through auxiliary_device_init(). It then attempts to register the device with auxiliary_device_add().

The error path is incorrectly structured. When auxiliary_device_add() returns a failure, control transfers to the aux_dev_uninit label, which calls auxiliary_device_uninit(). That call drops the final reference on the device and triggers the release callback ice_sf_dev_release(), which frees sf_dev via kfree(). Execution then falls through to the sf_dev_free label, which calls kfree(sf_dev) again on the freed pointer.

Root Cause

The root cause is improper goto label fall-through in the error unwind sequence. The kfree(sf_dev) call at sf_dev_free is only required when auxiliary_device_init() fails before reference counting is established. Once auxiliary_device_init() succeeds, ownership of the allocation transfers to the device model, and the release callback becomes responsible for freeing the memory.

Attack Vector

Triggering the flaw requires the auxiliary device registration to fail during subflow activation on an ice-managed interface. A local actor with privileges to configure SR-IOV subfunctions, or system conditions that exhaust resources during auxiliary_device_add(), can reach the buggy error path. The resulting double free corrupts kernel slab metadata.

No verified public exploit code is available. See the upstream fix commits for the precise patch:

Detection Methods for CVE-2026-46162

Indicators of Compromise

Kernel oops or panic messages referencing ice_sf_eth_activate, ice_sf_dev_release, or auxiliary_device_uninit in dmesg or /var/log/kern.log.
SLUB allocator warnings such as double free or corruption or kernel BUG at mm/slub.c correlated with ice subfunction activation attempts.
Repeated failures of subfunction (SF) port creation on Intel Ethernet adapters using the ice driver.

Detection Strategies

Enable CONFIG_SLUB_DEBUG and CONFIG_DEBUG_KMEMLEAK on test systems to surface double free conditions during SF activation testing.
Audit running kernel versions against the fix commit hashes (121d1f25, 2ca30340, 9aab1c3d, d0c6a481) using uname -r and distribution package metadata.
Use KASAN-enabled kernels in pre-production to catch use-after-free and double free events in the ice driver path.

Monitoring Recommendations

Centralize kernel logs and alert on BUG:, Oops:, and slab-out-of-bounds strings associated with the ice module.
Monitor host availability metrics on systems running Intel E810-series NICs where subfunctions are provisioned.
Track patch deployment status across the Linux fleet to confirm coverage of the four upstream fix commits.

How to Mitigate CVE-2026-46162

Immediate Actions Required

Apply the upstream kernel patches referenced in the fix commits and rebuild or update affected kernel packages.
Inventory all hosts running Intel ice-driver NICs and prioritize patching systems that provision SR-IOV subfunctions.
Restrict privileged operations that create or destroy ice subfunctions to trusted administrators until patches are deployed.

Patch Information

The fix retains kfree(sf_dev) only for the auxiliary_device_init() failure path and prevents fall-through to sf_dev_free after auxiliary_device_uninit() has been called. Apply the corresponding stable kernel updates from your distribution vendor that incorporate commits 121d1f25, 2ca30340, 9aab1c3d, and d0c6a481.

Workarounds

Avoid creating ice subfunction (SF) ports on unpatched kernels where auxiliary_device_add() may fail under resource pressure.
Unload the ice module on systems that do not require Intel Ethernet support while waiting for a patched kernel build.
Limit local administrative access to interfaces that invoke devlink subfunction management on affected hardware.

bash

# Verify the running kernel and ice driver module version
uname -r
modinfo ice | grep -E '^(version|srcversion|filename)'

# Check distribution package status for kernel updates
# Debian/Ubuntu
apt list --upgradable | grep linux-image
# RHEL/Rocky/Alma
dnf check-update kernel