CVE-2026-46162
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability has been identified in the Linux kernel that leads to a double free in the ice_sf_eth_activate() function on error. The issue occurs when the auxiliary_device_add() call fails, resulting in improper resource deallocation.
Risk Assessment
Double freeing memory can lead to system instability and potential DoS attacks, jeopardizing the integrity and availability of the system.
Recommendation
It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability and to monitor the system for any abnormal behavior.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ice: fix double free in ice_sf_eth_activate() error path When auxiliary_device_add() fails, ice_sf_eth_activate() jumps to aux_dev_uninit and calls auxiliary_device_uninit(&sf_dev->adev). The device release callback ice_sf_dev_release() frees sf_dev, but the current error path falls through to sf_dev_free and calls kfree(sf_dev) again, causing a double free. Keep kfree(sf_dev) for the auxiliary_device_init() failure path, but avoid falling through to sf_dev_free after auxiliary_device_uninit().