{"id":"CVE-2026-46162","title":"ice: fix double free in ice_sf_eth_activate() error path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix double free in ice_sf_eth_activate() error path\n\nWhen auxiliary_device_add() fails, ice_sf_eth_activate() jumps to\naux_dev_uninit and calls auxiliary_device_un…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < 2ca30340b5028ddc3f17086a538feeff06167b1b","Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < 121d1f253aed515cd85748f68c664a6cb756e8ad","Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < d0c6a4816609f145ffcc74e64baa214c571c17c6","Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < 9aab1c3d7299285e2569cbc0ed5892d631a241b2","Linux 6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:10:40.396215Z"},"published":"2026-05-28","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:13:42.354Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46162","references":[{"url":"https://git.kernel.org/stable/c/2ca30340b5028ddc3f17086a538feeff06167b1b"},{"url":"https://git.kernel.org/stable/c/121d1f253aed515cd85748f68c664a6cb756e8ad"},{"url":"https://git.kernel.org/stable/c/d0c6a4816609f145ffcc74e64baa214c571c17c6"},{"url":"https://git.kernel.org/stable/c/9aab1c3d7299285e2569cbc0ed5892d631a241b2"}],"tags":["cve.org"],"epss":0.00138,"epssPercentile":0.0321,"ingestedAt":"2026-11-06T16:57:43.328Z","slug":"CVE-2026-46162","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nice: fix double free in ice_sf_eth_activate() error path\n\nWhen auxiliary_device_add() fails, ice_sf_eth_activate() jumps to\naux_dev_uninit and calls auxiliary_device_uninit(&sf_dev->adev).\n\nThe device release callback ice_sf_dev_release() frees sf_dev, but\nthe current error path falls through to sf_dev_free and calls\nkfree(sf_dev) again, causing a double free.\n\nKeep kfree(sf_dev) for the auxiliary_device_init() failure path, but\navoid falling through to sf_dev_free after auxiliary_device_uninit().\n\n## Affected\n\n- `Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < 2ca30340b5028ddc3f17086a538feeff06167b1b`\n- `Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < 121d1f253aed515cd85748f68c664a6cb756e8ad`\n- `Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < d0c6a4816609f145ffcc74e64baa214c571c17c6`\n- `Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < 9aab1c3d7299285e2569cbc0ed5892d631a241b2`\n- `Linux 6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}