CVE-2026-53009 ice: fix double-free of tx_buf skb
A double-free vulnerability in the Linux kernel ice driver allows attackers to cause denial of service or potentially execute code via crafted network traffic.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53009?
CVE-2026-53009 is a high-severity use after free vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ice: fix double-free of tx_buf skb
If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time.
The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path.
The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch.
I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN.
I looked for similar bugs in related Intel drivers and did not find any.
Which versions are affected by CVE-2026-53009?
It affects 2 products.
Products include Linux kernel, Redhat Enterprise Linux.
How do I fix CVE-2026-53009?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-53009 being exploited?
There is no known exploitation of CVE-2026-53009 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90678, BELL-CVE-2026-53009, DEBIAN-CVE-2026-53009, GHSA-67p5-53x6-9j7q, ROOT-OS-DEBIAN-11-CVE-2026-53009, ROOT-OS-DEBIAN-12-CVE-2026-53009 and 4 more.