{"apiVersion":"1.0","identifier":"CVE-2026-99043","description":"In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata_dst refcount handling on representor teardown ice_eswitch_release_repr() uses metadata_dst_free() to release the representor-s metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry refcount. When ice_eswitch_port_start_xmit() processes a packet, it takes a reference via dst_hold() and attaches the metadata_dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata_dst is freed while references are still held. Use dst_release() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set. Other drivers sharing this pattern (nfp, airoha, bnxt) already use dst_release() for their metadata_dst lifecycle.","publishedAt":"2026-10-23T13:17:27","lastModifiedAt":"2026-10-30T13:21:41","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99043","cvssScore":null,"cvssVector":null,"epssProbability":0.00181,"riskScore":null,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99043","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99043","en":"https://www.redsauce.net/en/cves/CVE-2026-99043","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99043","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99043","de":"https://www.redsauce.net/de/cves/CVE-2026-99043","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99043","el":"https://www.redsauce.net/el/cves/CVE-2026-99043"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99043"}}