CVE-2026-53009— ice 驱动 tx_buf skb 双重释放漏洞
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2026-53009 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
ice: fix double-free of tx_buf skb
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time. The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path. The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch. I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN. I looked for similar bugs in related Intel drivers and did not find any.
来源: 美国国家漏洞数据库 NVD
CVSS Information
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
N/A
来源: 美国国家漏洞数据库 NVD
受影响产品
二、漏洞 CVE-2026-53009 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-53009 的情报信息
请登录查看更多情报信息。
CVE-2026-53009 补丁与修复 (2)
同批安全公告 · Linux · 2026-06-24 · 共 219 条
| CVE-2026-52980 | Linux内核公平调度器初始化时未清除相对截止期漏洞 | |
| CVE-2026-52993 | TIPC tipc_buf_append() 双重释放漏洞 | |
| CVE-2026-52991 | sched/psi 文件释放与压力写入间竞态条件漏洞 | |
| CVE-2026-52990 | fsnotify inode引用泄漏漏洞 | |
| CVE-2026-52988 | netfilter: nf_tables 在提交阶段使用 splice_list_rcu() 加入钩子列表 | |
| CVE-2026-52989 | nvmet-tcp 传播 nvmet_tcp_build_pdu_iovec() 错误到调用者 | |
| CVE-2026-52987 | AMD GPU 驱动用户队列验证中双重释放漏洞 | |
| CVE-2026-52986 | netfilter nf_conntrack_sip 漏洞 | |
| CVE-2026-52985 | netdevsim 虚拟网卡 iphdr结构体未初始化漏洞 | |
| CVE-2026-52984 | Linux netem 队列限制检查漏洞 | |
| CVE-2026-52982 | Realtek RTL8150 网卡 use-after-free 漏洞 | |
| CVE-2026-52983 | Airoha网络驱动TX路径BQL失衡漏洞 | |
| CVE-2026-52981 | 内核neigh模块skb所有权管理漏洞 | |
| CVE-2026-52979 | net: psp: 创建关联时检查设备注销 | |
| CVE-2026-52968 | KVM s390 PCI GAIT表索引双重缩放指针算法定位漏洞 | |
| CVE-2026-52972 | crypto: af_alg - AEAD附加数据长度限制漏洞 | |
| CVE-2026-52970 | nft_ct: obj eval缺失expect put导致漏洞 | |
| CVE-2026-52969 | KVM: kvm_reset_dirty_gfn() 回绕偏移拒绝漏洞 | |
| CVE-2026-52971 | ena: get_timestamp中潜在Use-after-Free漏洞 | |
| CVE-2026-52967 | SMB客户端符号链接无限循环及越界读取漏洞 |
显示前 20 条，共 219 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-53009
暂无评论