{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-99043 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-99043 is a vulnerability in Linux, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-99043 and fix it if it is affected.\n\nWhat it is: CVE-2026-99043 is a vulnerability in Linux, published on 23 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-99043 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-99043/ (Markdown: https://insights.sbomify.com/CVE-2026-99043/index.md)","id":"CVE-2026-99043","markdown":"https://insights.sbomify.com/CVE-2026-99043/index.md","name":"CVE-2026-99043","record":{"aliases":["AZL-110921","BELL-CVE-2026-99043","DEBIAN-CVE-2026-99043","GHSA-45qx-wx52-595w","UBUNTU-CVE-2026-99043"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix metadata_dst refcount handling on representor teardown\n\nice_eswitch_release_repr() uses metadata_dst_free() to release the\nrepresentor's metadata_dst.  metadata_dst_free() directly frees the\nunderlying memory without checking the dst_entry refcount.\n\nWhen ice_eswitch_port_start_xmit() processes a packet, it takes a\nreference via dst_hold() and attaches the metadata_dst to the skb.\nIf the representor is torn down while packets are still queued on\nthe lower device (e.g. in a qdisc), the metadata_dst is freed while\nreferences are still held.\n\nUse dst_release() instead, which correctly decrements the refcount\nand only frees the object when all references are dropped.  The dst\nsubsystem already handles metadata_dst cleanup in dst_destroy() when\nDST_METADATA is set.\n\nOther drivers sharing this pattern (nfp, airoha, bnxt) already use\ndst_release() for their metadata_dst lifecycle.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ice: fix metadata_dst refcount handling on representor teardown","id":"CVE-2026-99043","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"ice: fix use-after-free in dynamic port cleanup","id":"CVE-2026-99044"},"packages":[],"prev":{"headline":"io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6","id":"CVE-2026-99042"},"products":["Linux"],"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-23","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-99043/"}