CVE-2026-53009

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ice: fix double-free of tx_buf skb<br /> <br /> If ice_tso() or ice_tx_csum() fail, the error path in<br /> ice_xmit_frame_ring() frees the skb, but the &amp;#39;first&amp;#39; tx_buf still points<br /> to it and is marked as valid (ICE_TX_BUF_SKB).<br /> &amp;#39;next_to_use&amp;#39; remains unchanged, so the potential problem will<br /> likely fix itself when the next packet is transmitted and the tx_buf<br /> gets overwritten. But if there is no next packet and the interface is<br /> brought down instead, ice_clean_tx_ring() -&gt; ice_unmap_and_free_tx_buf()<br /> will find the tx_buf and free the skb for the second time.<br /> <br /> The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error<br /> path, so that ice_unmap_and_free_tx_buf().<br /> Move the initialization of &amp;#39;first&amp;#39; up, to ensure it&amp;#39;s already valid in<br /> case we hit the linearization error path.<br /> <br /> The bug was spotted by AI while I had it looking for something else.<br /> It also proposed an initial version of the patch.<br /> <br /> I reproduced the bug and tested the fix by adding code to inject<br /> failures, on a build with KASAN.<br /> <br /> I looked for similar bugs in related Intel drivers and did not find any.