CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-28 · updated 2026-06-17
Weakness: CWE-415

Description

In the Linux kernel, the following vulnerability has been resolved: ice: fix double free in ice_sf_eth_activate() error path When auxiliary_device_add() fails, ice_sf_eth_activate() jumps to aux_dev_uninit and calls auxiliary_device_uninit(&sf_dev->adev). The device release callback ice_sf_dev_release() frees sf_dev, but the current error path falls through to sf_dev_free and calls kfree(sf_dev) again, causing a double free. Keep kfree(sf_dev) for the auxiliary_device_init() failure path, but avoid falling through to sf_dev_free after auxiliary_device_uninit().

Affected products

Linux kernel: from 6.12 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.7 — fixed in 6.12.88, 6.18.30, 7.0.7

How to fix

Upgrade to a fixed version: Linux kernel 6.12.88, 6.18.30, 7.0.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-46162 or the next vulnerability affects your stack