CVE-2026-53009 Overview
CVE-2026-53009 is a double-free vulnerability in the Linux kernel's Intel ice Ethernet driver. The flaw resides in the transmit path of ice_xmit_frame_ring(). When ice_tso() or ice_tx_csum() fail, the error path frees the socket buffer (skb), but the first tx_buf descriptor still references the freed memory and remains marked as valid (ICE_TX_BUF_SKB). If the interface is brought down before another packet overwrites the stale descriptor, ice_clean_tx_ring() calls ice_unmap_and_free_tx_buf(), which frees the same skb a second time. The bug was identified with the assistance of AI-aided code review and reproduced with KASAN.
Critical Impact
Double-free in the kernel ice driver can corrupt the SLUB allocator state and lead to kernel memory corruption, system crash, or potential local privilege escalation on hosts using supported Intel Ethernet adapters.
Affected Products
- Linux kernel ice driver (Intel Ethernet 800-series controllers)
- Stable kernel branches receiving the fixes referenced in commits 1a303baa715e and 4c08fc2119ef
- Distributions packaging affected kernel versions for server and cloud workloads
Discovery Timeline
- 2026-06-24 - CVE-2026-53009 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53009
Vulnerability Analysis
The defect is a classic double-free [CWE-415] caused by inconsistent state tracking between the transmit descriptor ring and the in-flight skb. The ice_xmit_frame_ring() function assigns the outgoing skb to the first tx_buf and marks the buffer type as ICE_TX_BUF_SKB. If the subsequent TSO (TCP Segmentation Offload) or checksum offload helpers fail, the error path frees the skb directly but does not invalidate the tx_buf descriptor. The next_to_use ring index is also left unchanged.
Under normal traffic, the stale descriptor is overwritten by the next packet and the issue self-heals. However, when the interface is administratively brought down before further transmission, ring cleanup invokes ice_unmap_and_free_tx_buf() on the stale descriptor, releasing the already-freed skb a second time.
Root Cause
The root cause is a missing state reset on the error path. The first tx_buf type must be returned to ICE_TX_BUF_EMPTY after the skb is freed so that subsequent ring teardown does not attempt to free it again. The upstream fix resets the buffer type in the error path and moves the initialization of first earlier so the descriptor is in a consistent state when the linearization error path is taken.
Attack Vector
Triggering the bug requires inducing failure in ice_tso() or ice_tx_csum() followed by an interface down event. In practice, this occurs under memory pressure or with crafted packet workloads that exercise segmentation or checksum offload error paths on systems using the ice driver. Exploitation is local and bounded by the privileges needed to drive network workloads and toggle interface state, but successful triggering yields kernel heap corruption.
No public proof-of-concept exploit is available. Reproduction reported by the upstream submitter relied on injected failures and a KASAN-instrumented build.
Detection Methods for CVE-2026-53009
Indicators of Compromise
- KASAN reports referencing ice_unmap_and_free_tx_buf or ice_clean_tx_ring with a double-free or use-after-free classification
- Kernel oops or panic traces originating in the ice driver transmit cleanup path following an interface down event
- Repeated SLUB allocator warnings (kernel BUG at mm/slub.c) on hosts running affected kernels with Intel 800-series NICs
Detection Strategies
- Inventory running kernel versions and ice driver builds across the fleet and compare against the patched commits 1a303baa715e and 4c08fc2119ef
- Enable KASAN on representative test hosts to surface latent double-free conditions before deploying kernels to production
- Correlate ifdown/ip link set down events with subsequent kernel crash telemetry to identify systems exercising the vulnerable code path
Monitoring Recommendations
- Forward dmesg, kdump, and journald kernel logs to a central SIEM and alert on stack frames containing ice_clean_tx_ring or ice_unmap_and_free_tx_buf
- Track unexpected NIC resets, link flaps, and host reboots on systems with Intel ice-managed interfaces
- Monitor TSO and checksum offload error counters via ethtool -S for anomalous growth that may indicate the error path is being hit
How to Mitigate CVE-2026-53009
Immediate Actions Required
- Apply the upstream kernel patches referenced in commits 1a303baa715e and 4c08fc2119ef once they reach your distribution's stable channel
- Identify hosts using the ice driver with lspci -k | grep -A3 ice or ethtool -i <iface> and prioritize patching servers exposed to untrusted workloads
- Restrict local users and containerized workloads from arbitrarily toggling network interface state where feasible
Patch Information
The fix resets the first tx_buf type to ICE_TX_BUF_EMPTY in the error path of ice_xmit_frame_ring() so that ice_unmap_and_free_tx_buf() will not attempt to free the already-released skb. The initialization of first is also moved earlier in the function to guarantee a valid state across the linearization error path. Patched commits are available in the stable kernel tree at 1a303baa715e and 4c08fc2119ef.
Workarounds
- No supported workaround eliminates the defect without the kernel patch; mitigations only reduce exposure
- Avoid frequent ifdown operations on ice-managed interfaces under heavy TSO or checksum offload workloads
- Disable TSO and TX checksum offload on affected interfaces with ethtool -K <iface> tso off tx off to reduce the likelihood of hitting the failing error path, accepting the performance tradeoff
# Identify hosts running the ice driver and confirm patch level
ethtool -i eth0 | grep -E 'driver|version'
uname -r
# Temporary risk reduction: disable TSO and TX checksum offload
ethtool -K eth0 tso off tx off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
