Skip to content
Heist/ feed
Critical

ice: fix Rx page leak on multi-buffer frames

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ice: fix Rx page leak on multi-buffer frames The ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each buffer in the current frame. This function was introduced as part of handling multi-buffer XDP support in the ice driver. It works by iterating over the buffers from first_desc up to 1 plus the total number of fragments in the frame, cached from before the XDP program was executed. If the hardware posts a descriptor with a size of 0, the logic used in ice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added as fragments in ice_add_xdp_frag. Since the buffer isn't counted as a fragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't call ice_put_rx_buf(). Because we don't call ice_put_rx_buf(), we don't attempt to re-use the page or free it. This leaves a stale page in the ring, as we don't increment next_to_alloc. The ice_reuse_rx_page() assumes that the next_to_alloc has been incremented properly, and that it always points to a buffer with a NULL page. Since this function doesn't check, it will happily recycle a page over the top of the next_to_alloc buffer, losing track of the old page. Note that this leak only occurs for multi-buffer frames. The ice_put_rx_mbuf() function always handles at least one buffer, so a single-buffer frame will always get handled correctly. It is not clear precisely why the hardware hands us descriptors with a size of 0 sometime

Announced Source revision 1
Original source ↗

CVE-2025-39948

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-39948

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "ac1728cf370bec2e74fe6a2adf05b4629980d2b3",
        "lessThan": "8729dc4eeb502145418db5f2ca2192fd26f3efda",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "311813ed013c016d4b0b0985a9ee41f778489077",
        "lessThan": "80555adb5c892f0e21d243ae96ed997ee520aea9",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "743bbd93cf29f653fae0e1416a31f03231689911",
        "lessThan": "fcb5718ebfe7fd64144e3399280440cce361a3ae",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "743bbd93cf29f653fae0e1416a31f03231689911",
        "lessThan": "84bf1ac85af84d354c7a2fdbdc0d4efc8aaec34b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d445b59d30415bb56f4803f622d566bca06e0abc",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6.6.78",
        "lessThan": "6.6.160",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.12.14",
        "lessThan": "6.12.49",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.13.3",
        "lessThan": "6.14",
        "versionType": "semver"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/intel/ice/ice_txrx.c",
      "drivers/net/ethernet/intel/ice/ice_txrx.h"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.14"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.14",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.49",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.16.9",
        "versionType": "semver",
        "lessThanOrEqual": "6.16.*"
      },
      {
        "status": "unaffected",
        "version": "6.17",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/intel/ice/ice_txrx.c",
      "drivers/net/ethernet/intel/ice/ice_txrx.h"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-39948

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#46033 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement